baxian 1.2.59 → 1.2.61

package/dist/agent/manager.js

@@ -6,7 +6,7 @@ import { createSignalToken } from './phase-signal.js';
 import { tmuxInstallHint } from './preflight.js';
 import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, TASK_OWNER_ROLES, isSpecStagePhase, isGitHubRepo, parseGitRemote, repoIdentityKey, repoSlug, } from '../shared/index.js';
 import { buildProjectDriver, makeDriverExec } from '../platform/driver-host.js';
-import { DriverOpError } from '../platform/git-driver.js';
+import { DriverOpError, buildDriverRunContext, GitDriver } from '../platform/git-driver.js';
 import { checkOpenPrBinding } from '../platform/pr-binding.js';
 import { collectPendingFeedback, scanCommentSourcesOnce } from '../platform/feedback.js';
 import { recheckPassProvenance } from '../platform/verdict-engine.js';
@@ -17,15 +17,15 @@ import { createRunner, LocalRunner, shellQuote, resolveAgentHost, hostGroupKey,
 import { GH_EXEC_TIMEOUT_MS, GIT_NET_ENV, execNetwork } from './net-exec.js';
 import { findForeignTaskTip } from './lineage.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
-import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, } from './tmux.js';
+import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, PaneGoneError, } from './tmux.js';
 import { BranchManager, DirtyWorkdirError, ReviewHeadMismatchError, isAutoDeletableTaskBranch } from './branch.js';
-import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded } from './repo-store.js';
-import { PhaseSignalWatcher } from './phase-signal-watcher.js';
+import { RepoStore, createRepoStoreCache, moveFileIntoPlace, stageFileGuarded, canonicalSelfGuard } from './repo-store.js';
+import { PhaseSignalWatcher, } from './phase-signal-watcher.js';
 import { ReviewTransport, resolveServerPayloads } from './review-transport.js';
 import { buildPromptInline, buildGreetingPrompt, PromptSizeError, RequiredSkillsMissingError, MAX_PROMPT_BYTES_ROUTE_LIMIT, } from './prompt.js';
 import { ApiError } from '../errors.js';
 import { prepareConfig } from '../config/loader.js';
-import { resolveProjectTool } from '../config/validator.js';
+import { projectReviewMode, resolveProjectTool } from '../config/validator.js';
 import { SHA_HEX_SOURCE } from '../platform/types.js';
 export class EnsureSessionError extends Error {
     partial;
@@ -146,7 +146,11 @@ export function skillSubdirFor(runtime) {
     }
 }
 const DEFAULT_DISPATCH_ACK_TIMEOUT_MS = 30_000;
+const DEFAULT_NEED_INPUT_RETRY_INTERVAL_MS = 5_000;
 const DEFAULT_DISPATCH_SETTLE_TIMEOUT_MS = 3_000;
+// DELETE runtime cleanup runs while holding the deletion tombstone + rotated lock; an unbounded remote
+// probe/kill would block rollback/finally forever, so every tmux round-trip in it carries this deadline.
+const DELETE_CLEANUP_TIMEOUT_MS = 15_000;
 const GH_NET = { timeout: GH_EXEC_TIMEOUT_MS, retries: 1 };
 const PLATFORM_HEAD_SHA_RE = new RegExp(`^${SHA_HEX_SOURCE}$`);
 // 复核类失败（provenance/ack）与平台/瞬态失败分型：前者调用方退回 approved 重入闭环（计划 Task 8）
@@ -230,6 +234,7 @@ export class AgentManager {
     paneStreamerManager;
     postApproveStore;
     pluginRegistry;
+    platformDefaultBranchOf;
     platformDriverExec;
     phaseSignalWatcher;
     errorRecordStore;
@@ -237,6 +242,7 @@ export class AgentManager {
     reviewTransportInstance;
     serverReviewDriver;
     dispatchAckTimeoutMs;
+    needInputRetryIntervalMs;
     dispatchSettleTimeoutMs;
     dispatchAckResendIntervalMs = 3_000;
     taskMutationQueue = Promise.resolve();
@@ -252,6 +258,9 @@ export class AgentManager {
     manualCompactWaitMs = 5_000;
     runtimeLivenessProbeMs = 700;
     cleanComposerWaitMs = 5_000;
+    readyStableSamples = 3;
+    readyStableSpacingMs = 1_000;
+    pendingDispatchRetryByTask = new Map();
     cancelInterruptGuardWaitMs = DEFAULT_DISPATCH_ACK_TIMEOUT_MS + 5_000;
     manualReviewInFlight = new Set();
     markCompleteInFlight = new Set();
@@ -260,6 +269,9 @@ export class AgentManager {
     // 引用计数：cancelTask 与 startCreatedTaskSession 的清理段可合法并存（启动期 Stop），先完成者不得清掉后者的 guard。
     cancelCleanupInFlight = new Map();
     deletionInFlight = new Set();
+    // Diverged ids live in a separate set the DELETE finally never clears: a post-commit replaceConfig throw must fail-stop for the whole process.
+    divergedAgents = new Set();
+    deletionGeneration = new Map();
     compactInFlight = new Set();
     constructor(deps) {
         const config = prepareConfig(deps.config);
@@ -274,6 +286,7 @@ export class AgentManager {
         this.paneStreamerManager = deps.paneStreamerManager;
         this.postApproveStore = deps.postApproveStore ?? new PostApproveStore();
         this.pluginRegistry = deps.pluginRegistry;
+        this.platformDefaultBranchOf = deps.platformDefaultBranchOf;
         this.errorRecordStore = deps.errorRecordStore;
         this.phaseSignalWatcher = deps.phaseSignalWatcher
             ?? (deps.paneStreamerManager
@@ -281,8 +294,10 @@ export class AgentManager {
                     paneStreamerManager: deps.paneStreamerManager,
                     eventBus: deps.eventBus,
                     resolveAgent: (id) => this.getAgentConfig(id),
+                    commitNeedInputWatermark: (intent) => this.commitNeedInputWatermark(intent),
                 })
                 : undefined);
+        this.needInputRetryIntervalMs = deps.needInputRetryIntervalMs ?? DEFAULT_NEED_INPUT_RETRY_INTERVAL_MS;
         this.reviewStore = deps.reviewStore;
         this.dispatchAckTimeoutMs = deps.dispatchAckTimeoutMs ?? DEFAULT_DISPATCH_ACK_TIMEOUT_MS;
         this.dispatchSettleTimeoutMs = deps.dispatchSettleTimeoutMs ?? DEFAULT_DISPATCH_SETTLE_TIMEOUT_MS;
@@ -455,14 +470,62 @@ export class AgentManager {
             this.deletionInFlight.add(id);
         return null;
     }
+    // Scan + claim share createTask/dispatchPendingTask's withTaskLock, so a delete can't pass an active-scan that a concurrent in_progress commit then orphans.
+    async scanActiveThenClaimDeletion(targets) {
+        return this.withTaskLock(async () => {
+            for (const id of targets) {
+                const state = await this.agentStore.get(id);
+                const task = state?.taskId ? await this.taskStore.get(state.taskId) : null;
+                if (task && ACTIVE_TASK_STATUSES.has(task.status)) {
+                    return { ok: false, code: 'active', agentId: id, taskId: task.id };
+                }
+                if (state?.status === 'awaiting_human')
+                    continue;
+                if (state?.creationToken)
+                    return { ok: false, code: 'bootstrapping', agentId: id };
+            }
+            const targetSet = new Set(targets);
+            const referencing = (await this.taskStore.list({})).find(t => ACTIVE_TASK_STATUSES.has(t.status)
+                && ((t.preferredAgentId !== '' && targetSet.has(t.preferredAgentId))
+                    || (!!t.agentId && targetSet.has(t.agentId))
+                    || (!!t.devAgentId && targetSet.has(t.devAgentId))
+                    || (!!t.qaAgentId && targetSet.has(t.qaAgentId))
+                    || (!!t.researchAgentId && targetSet.has(t.researchAgentId))));
+            if (referencing)
+                return { ok: false, code: 'referencing', taskId: referencing.id };
+            const conflict = this.tryClaimDeletion(targets);
+            if (conflict)
+                return { ok: false, code: 'already-deleting', agentId: conflict };
+            return { ok: true };
+        });
+    }
     releaseDeletionClaim(agentIds) {
         for (const id of agentIds)
             this.deletionInFlight.delete(id);
     }
+    // A completed DELETE keeps blocking this id past tombstone release; the process dies with any suspended flow, so no persistence is needed.
+    bumpDeletionGeneration(agentId) {
+        this.deletionGeneration.set(agentId, this.deletionGenerationOf(agentId) + 1);
+    }
+    deletionGenerationOf(agentId) {
+        return this.deletionGeneration.get(agentId) ?? 0;
+    }
+    // Boolean tombstone alone is ABA-prone (delete→recreate same id); commits must hold both the tombstone-clear and an unchanged generation from entry.
+    deletionGateOpen(agentId, genAtEntry) {
+        return !this.isDeletionInFlight(agentId) && this.deletionGenerationOf(agentId) === genAtEntry;
+    }
     isDeletionInFlight(agentId) {
-        return this.deletionInFlight.has(agentId);
+        return this.deletionInFlight.has(agentId) || this.divergedAgents.has(agentId);
+    }
+    // replaceConfig 抛错后的 fail-stop：进入 divergedAgents（不随 DELETE finally 释放），重建/分配持续被拒直到重启。
+    retainTombstoneForDivergence(agentId) {
+        this.divergedAgents.add(agentId);
     }
-    async ensureSession(agentId, mode) {
+    async ensureSession(agentId, mode, opts = {}) {
+        const genAtEntry = opts.expectedGeneration ?? this.deletionGenerationOf(agentId);
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `agent ${agentId} is being deleted (or was deleted and recreated); refusing session work`);
+        }
         const agent = this.getAgentConfig(agentId);
         if (!agent) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `Unknown agent: ${agentId}`);
@@ -473,52 +536,81 @@ export class AgentManager {
         }
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
+        // Side-effects run inside the lifecycle section (serialized with DELETE cleanup) behind a re-checked generation gate; the entry gate is only a fast-fail.
+        return this.runUnderSessionLifecycle(agentId, () => this.ensureSessionLocked(tmux, runner, agent, project, agentId, mode, genAtEntry));
+    }
+    async ensureSessionLocked(tmux, runner, agent, project, agentId, mode, genAtEntry) {
+        const assertGenerationOpen = () => {
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new EnsureSessionError({ createdSession: false, agentId }, `agent ${agentId} is being deleted (or was deleted and recreated); refusing session work`);
+            }
+        };
+        assertGenerationOpen();
         let workdir;
         try {
             const resolved = await this.ensureWorkdir(agent, project, runner);
             workdir = resolved.workdir;
-            await this.agentStore.update(agentId, (existing) => {
-                if (!existing)
-                    return AGENT_STORE_NOOP;
-                return {
-                    ...existing,
-                    workdir,
-                    updatedAt: new Date().toISOString(),
-                };
-            });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `ensureWorkdir failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // Gate the Workdir write too: a DELETE→recreate during the slow ensureWorkdir must not persist a stale Workdir onto the new incarnation.
+        assertGenerationOpen();
+        await this.agentStore.update(agentId, (existing) => {
+            if (!existing || !this.deletionGateOpen(agentId, genAtEntry))
+                return AGENT_STORE_NOOP;
+            return { ...existing, workdir, updatedAt: new Date().toISOString() };
+        });
+        assertGenerationOpen();
         try {
             await this.provisionRepoSkills(runner, agent, workdir);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `skill provisioning failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        let alive;
+        assertGenerationOpen();
+        let snapshot;
         try {
-            alive = await tmux.hasSession(agentId);
+            snapshot = await tmux.getSessionSnapshot(agentId);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `tmux probe failed: ${err instanceof Error ? err.message : String(err)}; ` +
                 `if tmux is missing, ${tmuxInstallHint(agent.projectId)}`);
         }
-        if (mode === 'create' && alive) {
-            const reclaimed = await this.runUnderSessionLifecycle(agentId, () => this.reclaimHalfCreatedSession(tmux, agentId));
-            if (!reclaimed) {
-                throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
-                    `it creates itself — kill it manually or pick a different agent id`);
+        // Re-gate after the probe await: a DELETE may have tombstoned mid-probe, and build/adopt would else create a session cleanup can only reap later.
+        assertGenerationOpen();
+        if (!snapshot) {
+            return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
+        }
+        if (snapshot.claim === null) {
+            if (await this.reclaimHalfCreatedSession(tmux, agentId, snapshot)) {
+                return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
             }
+            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
+                `it creates itself — kill it manually or pick a different agent id`);
+        }
+        if (mode === 'create' || snapshot.claim !== agentId) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, mode === 'create'
+                ? `tmux session "${agentId}" already exists on host; baxian only manages sessions ` +
+                    `it creates itself — kill it manually or pick a different agent id`
+                : `tmux session "${agentId}" exists but @baxian-agent-id session claim mismatch ` +
+                    `(got "${snapshot.claim}"); baxian will not adopt foreign session — operator must intervene`);
         }
-        if (alive && (mode === 'runtime' || mode === 'recover')) {
-            return this.adoptOrRestartSession(tmux, runner, agent, agentId, workdir, workdir);
+        return this.adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, workdir, snapshot);
+    }
+    agentSkillScope(agentId) {
+        const projectId = this.getAgentConfig(agentId)?.projectId;
+        if (projectId === undefined || this.effectiveReviewMode(projectId) !== 'git') {
+            return { pluginTools: [] };
         }
-        return this.buildFreshSession(tmux, agent, agentId, workdir, workdir);
+        const project = this.getProjectConfig(projectId);
+        const tool = project === undefined ? undefined : resolveProjectTool(project);
+        return { pluginTools: tool === undefined ? [] : [tool] };
     }
     async provisionRepoSkills(runner, agent, workdir) {
         if (this.skillRegistry.names().length === 0)
             return;
+        const scope = this.agentSkillScope(agent.id);
         const subdir = skillSubdirFor(agent.runtime);
         const destRoot = `${workdir}/${subdir}`;
         await this.excludeInjectedSkills(runner, workdir, subdir);
@@ -528,8 +620,11 @@ export class AgentManager {
         // would execute a `!`cmd`` / inline a @path embedded in an untrusted task title/description
         // before the skill runs. Message-body payloads are not expanded, so this path is injection-safe.
         await this.runUnderSkillDirLock(this.skillDirLockKey(agent, workdir), async () => {
-            await this.ensureSkillDirSafe(runner, workdir, subdir);
-            await this.skillRegistry.materialize((path, content) => this.atomicWriteFile(runner, workdir, path, content), destRoot);
+            await this.ensureSkillDirSafe(runner, workdir, subdir, [
+                ...this.skillRegistry.names(),
+                ...this.skillRegistry.pluginSkillNames(scope),
+            ]);
+            await this.skillRegistry.materialize((path, content) => this.atomicWriteFile(runner, workdir, path, content), destRoot, scope);
         });
     }
     // A rollback only kills if no adoption bumped the generation since its create.
@@ -583,9 +678,10 @@ export class AgentManager {
                     return;
                 }
                 const runner = this.createRunnerFor(cfg);
-                const outcome = await new TmuxManager(runner).killSessionRef(ref);
-                if (outcome === 'stale-server') {
-                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): tmux server generation changed — leaving session ${ref.sessionId} untouched`);
+                // Rollback may run before or after the claim write, so accept empty-or-ours.
+                const outcome = await new TmuxManager(runner).killSessionRef(ref, { kind: 'emptyOr', claim: agentId });
+                if (outcome === 'refused') {
+                    console.warn(`[AgentManager] ${agentId} rollback (${reason}): tmux generation/claim changed — leaving session ${ref.sessionId} untouched`);
                 }
                 else if (outcome === 'killed') {
                     console.warn(`[AgentManager] ${agentId} rollback (${reason}): killed created session ${ref.sessionId}`);
@@ -629,10 +725,12 @@ export class AgentManager {
             throw new Error(`atomic skill write failed (${finalPath}): ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    async ensureSkillDirSafe(runner, workdir, subdir) {
+    async ensureSkillDirSafe(runner, workdir, subdir, keepNames) {
         const top = subdir.split('/')[0];
-        const keep = this.skillRegistry.names().map((n) => `! -name ${shellQuote(n)}`).join(' ');
-        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+        const keep = keepNames.map((n) => `! -name ${shellQuote(n)}`).join(' ');
+        const inner = 
+        // canonicalSelfGuard (cd+pwd -P) rejects a rebound MIDDLE ancestor, not just a symlinked leaf, so the find/rm can't escape.
+        `${canonicalSelfGuard(workdir)} && ` +
             `cd ${shellQuote(workdir)} && ` +
             `for d in ${top} ${subdir}; do if [ -L "$d" ]; then ` +
             `printf 'baxian: %s is a symlink -> %s; replace it with a real directory\\n' "$d" "$(readlink "$d")" >&2; ` +
@@ -650,17 +748,19 @@ export class AgentManager {
         if (this.skillRegistry.names().length === 0)
             return;
         await this.setSessionOptions(tmux, agentId, ref, [
-            ['@baxian-skills-version', this.skillRegistry.contentHash()],
+            ['@baxian-skills-version', this.skillRegistry.contentHash(this.agentSkillScope(agentId))],
         ]);
     }
-    async replSkillsStale(tmux, agentId) {
+    async replSkillsStale(tmux, agentId, ref) {
         if (this.skillRegistry.names().length === 0)
             return false;
-        const tagged = await tmux.getOption(agentId, '@baxian-skills-version');
-        return tagged !== this.skillRegistry.contentHash();
+        const tagged = await tmux.getSessionOptionByRef(ref, agentId, '@baxian-skills-version');
+        return tagged !== this.skillRegistry.contentHash(this.agentSkillScope(agentId));
     }
     async excludeInjectedSkills(runner, workdir, subdir) {
-        const inner = `[ ! -L ${shellQuote(workdir)} ] && [ -d ${shellQuote(workdir)} ] && ` +
+        const inner = 
+        // canonicalSelfGuard (cd+pwd -P) rejects a rebound MIDDLE ancestor too, so the info/exclude write can't escape.
+        `${canonicalSelfGuard(workdir)} && ` +
             `cd ${shellQuote(workdir)} && ` +
             `if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then echo BX_SKILLS_NON_GIT; exit 0; fi; ` +
             `tracked="$(git ls-files -- ${shellQuote(`${subdir}/baxian-*`)} 2>/dev/null | head -5)"; ` +
@@ -693,12 +793,26 @@ export class AgentManager {
     }
     // A name (or even a bare $id) can rebind to a same-name successor mid-flight;
     // every option write goes through the identity-checked by-ref batch.
-    async setSessionOptions(tmux, agentId, ref, entries) {
-        const outcome = await tmux.setSessionOptionsIfAlive(ref, entries);
+    async setSessionOptions(tmux, agentId, ref, entries, expectedClaim = agentId) {
+        const outcome = await tmux.setSessionOptionsIfAlive(ref, entries, { expectedClaim });
         if (outcome === 'gone') {
             throw new Error(`tmux session ${ref.sessionId} (${agentId}) vanished before its options could be applied`);
         }
     }
+    // Snapshot's claim check is a filter; the returned PaneRef re-proves generation+claim on every op.
+    async resolveClaimedPane(tmux, agentId, expectedPaneId) {
+        const snapshot = await tmux.getSessionSnapshot(agentId);
+        if (!snapshot)
+            throw new PaneGoneError(agentId, 'no tmux session');
+        if (snapshot.claim !== agentId) {
+            throw new PaneGoneError(agentId, `session claim mismatch (got "${snapshot.claim ?? 'null'}")`);
+        }
+        const pane = await tmux.getSinglePaneByRef(snapshot.ref, agentId);
+        if (expectedPaneId !== undefined && pane.paneId !== expectedPaneId) {
+            throw new PaneGoneError(agentId, `pane id changed (state ${expectedPaneId} != live ${pane.paneId})`);
+        }
+        return pane;
+    }
     async buildFreshSession(tmux, agent, agentId, workdir, sessionDir = workdir) {
         return this.runUnderSkillDirLock(this.skillDirLockKey(agent, sessionDir), () => this.buildFreshSessionLocked(tmux, agent, agentId, workdir, sessionDir));
     }
@@ -710,6 +824,7 @@ export class AgentManager {
         try {
             createdRef = await tmux.createSession(agentId, sessionDir);
             createdSession = true;
+            // First batch writes the claim itself, so it must prove the session is still unclaimed.
             await this.setSessionOptions(tmux, agentId, createdRef, [
                 ['@baxian-agent-id', agentId],
                 ['@baxian-runtime', agent.runtime],
@@ -719,20 +834,21 @@ export class AgentManager {
                 ['window-size', 'latest'],
                 ...this.runtimePinEntries(),
                 ['status-right', ''],
-            ]);
+            ], '');
             await tmux.setServerOption('extended-keys', 'on');
             await tmux.appendServerOptionIfMissing('terminal-features', 'xterm*:extkeys');
-            const paneId = await tmux.getSinglePaneIdByRef(createdRef);
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            const pane = await tmux.getSinglePaneByRef(createdRef, agentId);
+            await tmux.sendKeysLiteral(pane, launchCommandIn(sessionDir, agent));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, createdRef);
-            return { ok: true, createdSession: true, freshRuntime: true, paneId, workdir, sessionRef: createdRef };
+            return { ok: true, createdSession: true, freshRuntime: true, paneId: pane.paneId, pane, workdir, sessionRef: createdRef };
         }
         catch (err) {
             const partial = { createdSession, agentId, genAtCreate };
@@ -755,7 +871,7 @@ export class AgentManager {
         }
         try {
             const result = await this.ensureSession(agentId, 'create');
-            if (!(await this.runGreetingHandshake(agentId, cfgAtStart, result.paneId))) {
+            if (!(await this.runGreetingHandshake(agentId, cfgAtStart, result.pane))) {
                 const current = await this.agentStore.get(agentId);
                 if (current && current.creationToken !== creationToken) {
                     console.warn(`[bootstrap] ${agentId} creationToken changed during greeting — leaving the session to its successor`);
@@ -816,7 +932,7 @@ export class AgentManager {
             await this.markBootstrapFailed(agentId, creationToken, message);
         }
     }
-    async runGreetingHandshake(agentId, agent, paneId) {
+    async runGreetingHandshake(agentId, agent, pane) {
         const watcher = this.phaseSignalWatcher;
         if (!watcher)
             return true;
@@ -824,7 +940,7 @@ export class AgentManager {
         for (let attempt = 1; attempt <= this.greetingMaxAttempts; attempt++) {
             const token = createSignalToken();
             try {
-                await this.injectAndAwaitAckSteps(tmux, paneId, buildGreetingPrompt(token, agent.runtime), agentId, agent.runtime);
+                await this.injectAndAwaitAckSteps(tmux, pane, buildGreetingPrompt(token, agent.runtime), agentId, agent.runtime);
             }
             catch (err) {
                 console.warn(`[bootstrap] greeting inject failed for ${agentId} (attempt ${attempt}):`, err);
@@ -843,7 +959,7 @@ export class AgentManager {
             console.warn(`[bootstrap] greeting attempt ${attempt}/${this.greetingMaxAttempts} for ${agentId}: ${outcome}`);
             if (outcome === 'no-agent')
                 break;
-            if (attempt < this.greetingMaxAttempts && !(await this.clearComposerForReuse(tmux, paneId, agentId))) {
+            if (attempt < this.greetingMaxAttempts && !(await this.clearComposerForReuse(tmux, pane, agentId))) {
                 break;
             }
         }
@@ -885,21 +1001,25 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             return false;
+        // Pin the incarnation before reading state so a DELETE→recreate reusing %0 can't route the greeting handshake to the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         if (state?.awaitingPhase !== 'greeting_failed')
             return false;
         const guardSince = state.awaitingSince;
-        let paneId = state.paneId;
-        if (!paneId) {
-            try {
-                paneId = await new TmuxManager(this.createRunnerFor(agent)).getSinglePaneId(agentId);
-            }
-            catch (err) {
-                console.warn(`[regreet] cannot resolve pane for ${agentId}:`, err);
-                return true;
-            }
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return false;
+        let pane;
+        try {
+            pane = await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(agent)), agentId, state.paneId);
+        }
+        catch (err) {
+            console.warn(`[regreet] cannot resolve pane for ${agentId}:`, err);
+            return true;
         }
-        if (!(await this.runGreetingHandshake(agentId, agent, paneId))) {
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return false;
+        if (!(await this.runGreetingHandshake(agentId, agent, pane))) {
             return true;
         }
         await this.agentStore.update(agentId, (fresh) => {
@@ -936,8 +1056,7 @@ export class AgentManager {
         let paneId = existing.paneId;
         if (cfg && !paneId) {
             try {
-                const runner = this.createRunnerFor(cfg);
-                paneId = await new TmuxManager(runner).getSinglePaneId(agentId);
+                paneId = (await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), agentId)).paneId;
             }
             catch {
             }
@@ -1014,8 +1133,10 @@ export class AgentManager {
         if (!(err instanceof EnsureSessionError) || !err.partial.dialogPending) {
             return false;
         }
+        // The error belongs to the caller's incarnation; gate every side-effect so a DELETE→recreate reusing %0 can't write the stale dialog/fail onto the new agent.
+        const gateOpen = () => opts.expectedGeneration === undefined || this.deletionGateOpen(agentId, opts.expectedGeneration);
         let state = await this.agentStore.get(agentId);
-        if (!state)
+        if (!state || !gateOpen())
             return false;
         if (state.paneId === undefined && err.partial.createdSession) {
             const cfg = this.getAgentConfig(agentId);
@@ -1023,8 +1144,7 @@ export class AgentManager {
                 return false;
             let discoveredPaneId;
             try {
-                const runner = this.createRunnerFor(cfg);
-                discoveredPaneId = await new TmuxManager(runner).getSinglePaneId(agentId);
+                discoveredPaneId = (await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), agentId)).paneId;
             }
             catch (probeErr) {
                 console.warn(`[AgentManager] handleDialogPendingFromRuntime: tmux probe paneId failed for ${agentId}:`, probeErr);
@@ -1034,7 +1154,7 @@ export class AgentManager {
                 return false;
             const probeNow = new Date().toISOString();
             await this.agentStore.update(agentId, (fresh) => {
-                if (!fresh)
+                if (!fresh || !gateOpen())
                     return AGENT_STORE_NOOP;
                 if (fresh.paneId !== undefined)
                     return AGENT_STORE_NOOP;
@@ -1048,6 +1168,8 @@ export class AgentManager {
             console.warn(`[AgentManager] handleDialogPendingFromRuntime: ${agentId} has no paneId/taskId snapshot (no generation guard); refusing — caller should rollback`);
             return false;
         }
+        if (!gateOpen())
+            return false;
         await this.markDialogPending(agentId, undefined, {
             runtimePath: true,
             ...(state.paneId !== undefined ? { expectedPaneId: state.paneId } : {}),
@@ -1117,15 +1239,16 @@ export class AgentManager {
                 return;
             if (generationMismatch(state))
                 return;
-            let paneId;
+            let pane;
             try {
-                paneId = await tmux.getSinglePaneId(agentId);
+                pane = await this.resolveClaimedPane(tmux, agentId);
             }
             catch {
                 continue;
             }
+            const paneId = pane.paneId;
             try {
-                await tmux.waitReplReady(paneId, runtime, {
+                await tmux.waitReplReady(pane, runtime, {
                     timeoutMs: 1_000,
                     intervalMs: 200,
                     scrollback: 0,
@@ -1143,7 +1266,7 @@ export class AgentManager {
             let projectIdForEmit = '';
             let wrote = false;
             const isBootstrapPath = creationToken !== undefined;
-            if (isBootstrapPath && !(await this.runGreetingHandshake(agentId, cfg, paneId))) {
+            if (isBootstrapPath && !(await this.runGreetingHandshake(agentId, cfg, pane))) {
                 await this.markGreetingFailed(agentId, creationToken);
                 return;
             }
@@ -1238,7 +1361,8 @@ export class AgentManager {
                 continue;
             let stripped;
             try {
-                stripped = await tmux.capturePaneById(state.paneId, { ansi: false, scrollback: 0 });
+                const pane = await this.resolveClaimedPane(tmux, agentId, state.paneId);
+                stripped = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
             }
             catch {
                 continue;
@@ -1279,29 +1403,9 @@ export class AgentManager {
             signal.addEventListener('abort', onAbort, { once: true });
         });
     }
-    // Claim snapshot and adoption declaration share one critical section with rollbacks.
-    async adoptOrRestartSession(tmux, runner, agent, agentId, workdir, sessionDir) {
-        return this.runUnderSessionLifecycle(agentId, () => this.adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir));
-    }
-    async adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir) {
-        let snapshot;
-        try {
-            snapshot = await tmux.getSessionSnapshot(agentId);
-        }
-        catch (err) {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `session snapshot failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        if (!snapshot) {
-            return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
-        }
+    // Runs inside the caller's lifecycle section (ensureSessionLocked routed the snapshot here).
+    async adoptOrRestartSessionLocked(tmux, runner, agent, agentId, workdir, sessionDir, snapshot) {
         const sessionRef = snapshot.ref;
-        if (snapshot.claim !== agentId) {
-            if (snapshot.claim === null && await this.reclaimHalfCreatedSession(tmux, agentId, snapshot)) {
-                return this.buildFreshSession(tmux, agent, agentId, workdir, sessionDir);
-            }
-            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux session "${agentId}" exists but @baxian-agent-id session claim mismatch ` +
-                `(got "${snapshot.claim ?? 'null'}"); baxian will not adopt foreign session — operator must intervene`);
-        }
         this.adoptGeneration.set(agentId, (this.adoptGeneration.get(agentId) ?? 0) + 1);
         try {
             await this.setSessionOptions(tmux, agentId, sessionRef, this.runtimePinEntries());
@@ -1309,24 +1413,25 @@ export class AgentManager {
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `pinning runtime session options failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        let paneId;
+        let pane;
         try {
-            paneId = await tmux.getSinglePaneIdByRef(sessionRef);
+            pane = await tmux.getSinglePaneByRef(sessionRef, agentId);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `getSinglePaneId failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        const paneId = pane.paneId;
         const runtime = agentRuntimeKindFor(agent);
         let state;
         try {
-            state = await tmux.classifyPaneForAdopt(paneId, runtime);
+            state = await tmux.classifyPaneForAdopt(pane, runtime);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `classifyPaneForAdopt failed: ${err instanceof Error ? err.message : String(err)}`);
         }
         let currentPath;
         try {
-            currentPath = await tmux.getPaneCurrentPath(paneId);
+            currentPath = await tmux.getPaneCurrentPath(pane);
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `pane current path probe failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1341,7 +1446,7 @@ export class AgentManager {
         if (!pathMatches) {
             if (state.kind === 'live-runtime') {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, agent.runtime, this.cleanComposerWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, agent.runtime, this.cleanComposerWaitMs);
                 }
                 catch (err) {
                     throw new EnsureSessionError({ createdSession: false, agentId }, `Workdir change requires an idle runtime: ${err instanceof Error ? err.message : String(err)}`);
@@ -1358,7 +1463,7 @@ export class AgentManager {
             case 'live-runtime': {
                 let stale;
                 try {
-                    stale = await this.replSkillsStale(tmux, agentId);
+                    stale = await this.replSkillsStale(tmux, agentId, sessionRef);
                 }
                 catch (err) {
                     throw new EnsureSessionError({ createdSession: false, agentId }, `skills-version probe failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1370,11 +1475,12 @@ export class AgentManager {
                         freshRuntime: false,
                         skillsStale: true,
                         paneId,
+                        pane,
                         workdir,
                         sessionRef,
                     };
                 }
-                return { ok: true, createdSession: false, freshRuntime: false, paneId, workdir, sessionRef };
+                return { ok: true, createdSession: false, freshRuntime: false, paneId, pane, workdir, sessionRef };
             }
             case 'startup-dialog':
                 throw new EnsureSessionError({
@@ -1389,15 +1495,15 @@ export class AgentManager {
                     `must reset the pane manually`);
             case 'trust-dialog':
                 try {
-                    await tmux.handleTrustDialog(paneId, runtime, {
+                    await tmux.handleTrustDialog(pane, runtime, {
                         timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
                     });
-                    await tmux.waitReplReady(paneId, runtime, {
+                    await tmux.waitReplReady(pane, runtime, {
                         timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                         scrollback: 0,
                     });
                     await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
-                    return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
+                    return { ok: true, createdSession: false, freshRuntime: true, paneId, pane, workdir, sessionRef };
                 }
                 catch (trustErr) {
                     if (trustErr instanceof ReplNotReadyError && detectStartupDialog(trustErr.lastScreen, runtime)) {
@@ -1415,16 +1521,17 @@ export class AgentManager {
                 break;
         }
         try {
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(sessionDir, agent)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            await tmux.sendKeysLiteral(pane, launchCommandIn(sessionDir, agent));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, sessionRef);
-            return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir, sessionRef };
+            return { ok: true, createdSession: false, freshRuntime: true, paneId, pane, workdir, sessionRef };
         }
         catch (relErr) {
             if (relErr instanceof ReplNotReadyError && detectStartupDialog(relErr.lastScreen, runtime)) {
@@ -1464,12 +1571,12 @@ export class AgentManager {
         let outcome;
         try {
             // claim-still-empty rides the kill itself — a claim racing the probes makes the server refuse.
-            outcome = await tmux.killSessionRef(snapshot.ref, { onlyIfUnclaimed: true });
+            outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'unclaimed' });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (half-created leftover) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (outcome === 'refused' || outcome === 'stale-server') {
+        if (outcome === 'refused') {
             throw new EnsureSessionError({ createdSession: false, agentId }, `session ${snapshot.ref.sessionId} was claimed (or its server changed) while reclaiming the half-created leftover — retry to observe the new state`);
         }
         if (outcome === 'killed') {
@@ -1483,13 +1590,13 @@ export class AgentManager {
     async killAdoptTarget(tmux, agentId, sessionRef, reason) {
         let outcome;
         try {
-            outcome = await tmux.killSessionRef(sessionRef);
+            outcome = await tmux.killSessionRef(sessionRef, { kind: 'equals', claim: agentId });
         }
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `killSessionRef (${reason}) failed: ${err instanceof Error ? err.message : String(err)}`);
         }
-        if (outcome === 'stale-server') {
-            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux server generation changed while replacing session (${reason}); retry to observe the new state`);
+        if (outcome === 'refused') {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `tmux generation/claim changed while replacing session (${reason}); retry to observe the new state`);
         }
         if (outcome === 'killed') {
             console.warn(`[AgentManager] ${agentId}: killed session ${sessionRef.sessionId} (${reason})`);
@@ -1498,7 +1605,17 @@ export class AgentManager {
             console.warn(`[AgentManager] ${agentId}: session ${sessionRef.sessionId} already gone (${reason})`);
         }
     }
-    async acquireAgentForTask(agentId, taskId, phase) {
+    // Create-on-null only under this predicate (evaluated inside the store's serialized commit): closes the delete→recreate ABA yet keeps lazy first-allocation for config-only agents.
+    bindingInitPredicate(agentId, genAtEntry) {
+        return this.deletionGateOpen(agentId, genAtEntry) && this.getAgentConfig(agentId) !== undefined;
+    }
+    async acquireAgentForTask(agentId, taskId, phase, 
+    // 锁代必须由 acquire 原子交出：事后重读 claim/binding 的窗口里并发派发方可以
+    // release + re-acquire 同一 agent/同一 task，读到的会是 successor 的代
+    opts = {}) {
+        const genAtEntry = this.deletionGenerationOf(agentId);
+        if (this.isDeletionInFlight(agentId))
+            return false;
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`Unknown agent: ${agentId}`);
@@ -1522,16 +1639,45 @@ export class AgentManager {
         const token = reuseLock ? existingToken : await this.lockManager.acquire(agentId, taskId);
         if (!token)
             return false;
+        const releaseAcquired = async (originalErr) => {
+            if (reuseLock)
+                return;
+            try {
+                await this.lockManager.releaseIfOwner(agentId, taskId, token);
+            }
+            catch (releaseErr) {
+                console.warn(`[AgentManager] acquireAgentForTask(${agentId}, ${taskId}): lock release after ` +
+                    `${originalErr === undefined ? 'refused commit' : 'commit failure'} itself failed:`, releaseErr);
+            }
+        };
         const now = new Date().toISOString();
-        await this.agentStore.update(agentId, (existing) => ({
-            ...(existing ?? { id: agentId, projectId: cfg.projectId, updatedAt: now }),
-            id: agentId,
-            projectId: cfg.projectId,
-            taskId,
-            lockToken: token,
-            ...(phase === 'code' && !sameTaskReentry ? { bootstrappingTaskId: taskId } : {}),
-            updatedAt: now,
-        }));
+        let commit;
+        try {
+            commit = await this.agentStore.update(agentId, (existing) => {
+                if (existing === null && !this.bindingInitPredicate(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
+                if (!this.deletionGateOpen(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
+                return {
+                    ...(existing ?? { id: agentId, projectId: cfg.projectId, updatedAt: now }),
+                    id: agentId,
+                    projectId: cfg.projectId,
+                    taskId,
+                    lockToken: token,
+                    ...(phase === 'code' && !sameTaskReentry ? { bootstrappingTaskId: taskId } : {}),
+                    updatedAt: now,
+                };
+            });
+        }
+        catch (err) {
+            await releaseAcquired(err);
+            throw err;
+        }
+        if (commit !== 'committed') {
+            await releaseAcquired();
+            return false;
+        }
+        opts.onAcquired?.(token);
         return true;
     }
     async releaseAgentForTask(agentId, expectedTaskId, mode, opts = {}) {
@@ -1618,11 +1764,15 @@ export class AgentManager {
                             ...(latest.workdir !== undefined ? { workdir: latest.workdir } : {}),
                             ...(latest.startedAt !== undefined ? { startedAt: latest.startedAt } : {}),
                             ...(latest.creationToken !== undefined ? { creationToken: latest.creationToken } : {}),
+                            // Release voids the open question: strip the watermark, bump the epoch so
+                            // any in-flight/queued commit of the old generation fences server-side.
+                            needInput: { epoch: (latest.needInput?.epoch ?? 0) + 1 },
                         };
                         return cleared;
                     }
                     return {
                         ...latest,
+                        needInput: { epoch: (latest.needInput?.epoch ?? 0) + 1 },
                         updatedAt: now,
                     };
                 });
@@ -1630,6 +1780,7 @@ export class AgentManager {
                     console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} holds a newer generation than the captured one; keeping the hold`);
                     return false;
                 }
+                this.clearNeedInputRetryFor(agentId, expectedTaskId);
                 return true;
             }
             let sessionConfirmedAbsent = false;
@@ -1691,7 +1842,7 @@ export class AgentManager {
                         return hold(runtime.reason);
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
                     if (runtime.kind === 'pane') {
-                        if (state.paneId !== runtime.paneId) {
+                        if (state.paneId !== runtime.pane.paneId) {
                             await this.agentStore.update(agentId, (latest) => {
                                 if (!latest
                                     || latest.taskId !== expectedTaskId
@@ -1699,14 +1850,14 @@ export class AgentManager {
                                     || latest.workdir !== releaseWorkdir) {
                                     return AGENT_STORE_NOOP;
                                 }
-                                return { ...latest, paneId: runtime.paneId, updatedAt: new Date().toISOString() };
+                                return { ...latest, paneId: runtime.pane.paneId, updatedAt: new Date().toISOString() };
                             });
                             const refreshed = await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
-                            if (refreshed.paneId !== runtime.paneId) {
+                            if (refreshed.paneId !== runtime.pane.paneId) {
                                 throw new Error(`Agent ${agentId} runtime pane changed during release; operation aborted`);
                             }
                         }
-                        await this.waitForReplPromptReady(tmux, runtime.paneId, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
+                        await this.waitForReplPromptReady(tmux, runtime.pane, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
                     }
                     else {
                         sessionConfirmedAbsent = true;
@@ -1784,6 +1935,14 @@ export class AgentManager {
                     await this.assertTaskGeneration(agentId, expectedTaskId, lockToken, releaseWorkdir);
                 }
                 catch (err) {
+                    // REPL 忙碌不是清理失败：pane 完好、绑定未动、非 dev 无分支凭据可留。落
+                    // branch-cleanup-pending（不在可恢复白名单）会把常态忙碌变成永久 hold（#558 验收 1），
+                    // 故拒绝释放而不落 hold，由调用方按「仍绑定且未 hold」判定重新排队本 pass
+                    if (opts.deferWhenBusy && err instanceof ReplNotReadyError && cfg.role !== 'dev') {
+                        console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} REPL is busy; refusing release without a hold ` +
+                            `(the pass can be re-queued): ${err.message}`);
+                        return false;
+                    }
                     const reason = err instanceof DirtyWorkdirError
                         ? err.message
                         : `checkout cleanup failed: ${err instanceof Error ? err.message : String(err)}`;
@@ -1816,6 +1975,7 @@ export class AgentManager {
                     ...(existing.workdir !== undefined ? { workdir: existing.workdir } : {}),
                     ...(!sessionConfirmedAbsent && existing.paneId !== undefined ? { paneId: existing.paneId } : {}),
                     ...(existing.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
+                    needInput: { epoch: (existing.needInput?.epoch ?? 0) + 1 },
                     updatedAt: now,
                 };
             });
@@ -1823,6 +1983,7 @@ export class AgentManager {
                 console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} hold generation changed during release; keeping the hold`);
                 return false;
             }
+            this.clearNeedInputRetryFor(agentId, expectedTaskId);
             return this.lockManager.releaseIfOwner(agentId, expectedTaskId, lockToken);
         });
     }
@@ -1909,6 +2070,8 @@ export class AgentManager {
             if (candidateTasks.length === 0)
                 continue;
             const candidateByBranch = new Map(candidateTasks.map(task => [task.branch, task]));
+            // Pin the incarnation before the first state/workdir/refs snapshot so a DELETE→same-id recreate (possibly a different workdir) in the read→gate window is rejected.
+            const genAtEntry = this.deletionGenerationOf(cfg.id);
             const state = await this.agentStore.get(cfg.id);
             if (!state || !canDispatchWithBinding(state))
                 continue;
@@ -1928,11 +2091,15 @@ export class AgentManager {
             }
             if (!refs.some(ref => candidateByBranch.has(ref.slice('refs/heads/'.length))))
                 continue;
+            if (this.isDeletionInFlight(cfg.id))
+                continue;
             const token = await this.lockManager.acquire(cfg.id, owner);
             if (!token)
                 continue;
             const cleanupResults = [];
             try {
+                if (!this.deletionGateOpen(cfg.id, genAtEntry))
+                    continue;
                 const lockedState = await this.agentStore.get(cfg.id);
                 if (!lockedState || !canDispatchWithBinding(lockedState))
                     continue;
@@ -1944,12 +2111,8 @@ export class AgentManager {
                     continue;
                 const tmux = new TmuxManager(runner);
                 if (await tmux.hasSession(cfg.id)) {
-                    const claim = await tmux.getOption(cfg.id, '@baxian-agent-id');
-                    if (claim !== cfg.id) {
-                        throw new Error(`tmux session claim mismatch for ${cfg.id}: ${claim ?? '<missing>'}`);
-                    }
-                    const paneId = lockedState.paneId ?? await tmux.getSinglePaneId(cfg.id);
-                    await this.waitForReplPromptReady(tmux, paneId, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
+                    const pane = await this.resolveClaimedPane(tmux, cfg.id, lockedState.paneId ?? undefined);
+                    await this.waitForReplPromptReady(tmux, pane, agentRuntimeKindFor(cfg), this.cleanComposerWaitMs);
                 }
                 if (!(await this.lockManager.isOwner(cfg.id, owner, token)))
                     continue;
@@ -2006,48 +2169,469 @@ export class AgentManager {
             }
         }
     }
-    async setAgentNeedInput(agentId, pending, opts = {}) {
-        const now = new Date().toISOString();
+    // ---- need-input watermark: epoch-fenced monotonic persistence + retry convergence ----
+    needInputRetry = new Map();
+    needInputRetryInFlight = new Set();
+    // Watermark writes currently in the store chain. A restore bump snapshots these along
+    // with the queue: an answer whose write has not settled yet would otherwise be invisible
+    // to the migration and its error-enqueue would land after the arm already cleared the
+    // queue — deleting the only proof the user answered.
+    needInputWritesInFlight = new Map();
+    needInputWriteSeq = 0;
+    // Serializes the probe→bump→queue-clear section of concurrent arms for one
+    // (agentId, taskId): without it a stale replay probed before a successor's bump can
+    // itself bump afterwards, ghost-fencing the installed successor. All locked steps are
+    // bounded (memory probe + one store update); subscribe stays outside the lock.
+    needInputArmLocks = new Map();
+    needInputRetryTimer = null;
+    needInputRetryKey(agentId, taskId, epoch) {
+        return `${agentId} ${taskId} ${epoch}`;
+    }
+    parseNeedInputRetryKey(key) {
+        const [agentId, taskId, epochRaw] = key.split(' ');
+        if (!agentId || !taskId || epochRaw === undefined)
+            return null;
+        const epoch = Number.parseInt(epochRaw, 10);
+        if (!Number.isFinite(epoch))
+            return null;
+        return { agentId, taskId, epoch };
+    }
+    // Standard commit entry: one agentStore.update, NEVER called from inside another
+    // updater (the store's per-id chain is non-reentrant).
+    // The ledger entry lives until the result is fully handed over — an error is IN the
+    // retry queue before deregistration, in the same synchronous continuation. Splitting
+    // those two across promise jobs would open a window where neither the ledger nor the
+    // queue holds the intent and a concurrent restore snapshot loses the answer.
+    async commitNeedInputWatermark(intent) {
+        const writeId = ++this.needInputWriteSeq;
+        this.needInputWritesInFlight.set(writeId, intent);
+        const key = this.needInputRetryKey(intent.agentId, intent.taskId, intent.epoch);
         try {
-            await this.agentStore.update(agentId, (existing) => {
-                if (!existing)
+            const result = await this.writeNeedInputWatermark(intent);
+            if (result === 'error') {
+                this.enqueueNeedInputRetry(key, intent.askSeq, intent.answeredSeq);
+            }
+            else {
+                this.settleNeedInputRetry(key, intent.askSeq, intent.answeredSeq, result);
+            }
+            return result;
+        }
+        catch (err) {
+            this.enqueueNeedInputRetry(key, intent.askSeq, intent.answeredSeq);
+            throw err;
+        }
+        finally {
+            this.needInputWritesInFlight.delete(writeId);
+        }
+    }
+    async writeNeedInputWatermark(intent) {
+        let outcome = 'fenced';
+        try {
+            await this.agentStore.update(intent.agentId, (existing) => {
+                if (!existing || existing.taskId !== intent.taskId) {
+                    outcome = 'fenced';
                     return AGENT_STORE_NOOP;
-                // A stale watcher callback must not stamp a rebound agent: the badge belongs
-                // to the watch's task, so a taskId mismatch means the binding moved on.
-                if (opts.taskId !== undefined && existing.taskId !== opts.taskId)
+                }
+                const cur = existing.needInput;
+                if ((cur?.epoch ?? 0) !== intent.epoch) {
+                    outcome = 'fenced';
                     return AGENT_STORE_NOOP;
-                if (pending) {
-                    if (existing.needInputAt !== undefined)
-                        return AGENT_STORE_NOOP;
-                    return { ...existing, needInputAt: now, updatedAt: now };
                 }
-                if (existing.needInputAt === undefined)
+                const askSeq = Math.max(cur?.askSeq ?? 0, intent.askSeq);
+                const answeredSeq = Math.max(cur?.answeredSeq ?? 0, intent.answeredSeq);
+                outcome = 'ok';
+                if (cur && (cur.askSeq ?? 0) === askSeq && (cur.answeredSeq ?? 0) === answeredSeq) {
+                    return AGENT_STORE_NOOP;
+                }
+                const now = new Date().toISOString();
+                const at = askSeq > answeredSeq ? (cur?.at ?? now) : undefined;
+                return {
+                    ...existing,
+                    needInput: {
+                        epoch: intent.epoch, askSeq, answeredSeq,
+                        ...(at !== undefined ? { at } : {}),
+                        ...(cur?.cutoverToken !== undefined ? { cutoverToken: cur.cutoverToken } : {}),
+                    },
+                    updatedAt: now,
+                };
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] needInput watermark write failed (agent=${intent.agentId} epoch=${intent.epoch}):`, err);
+            return 'error';
+        }
+        return outcome;
+    }
+    enqueueNeedInputRetry(key, askSeq, answeredSeq) {
+        const cur = this.needInputRetry.get(key);
+        this.needInputRetry.set(key, {
+            askSeq: Math.max(cur?.askSeq ?? 0, askSeq),
+            answeredSeq: Math.max(cur?.answeredSeq ?? 0, answeredSeq),
+        });
+        this.ensureNeedInputRetryTimer();
+    }
+    // ok deletes only when the queued item is still covered by what was written
+    // (a concurrent edge may have raised it mid-flight); fenced is terminal either way.
+    settleNeedInputRetry(key, wroteAskSeq, wroteAnsweredSeq, result) {
+        const cur = this.needInputRetry.get(key);
+        if (!cur)
+            return;
+        if (result === 'fenced' || (cur.askSeq <= wroteAskSeq && cur.answeredSeq <= wroteAnsweredSeq)) {
+            this.needInputRetry.delete(key);
+            this.ensureNeedInputRetryTimer();
+        }
+    }
+    clearNeedInputRetryFor(agentId, taskId) {
+        for (const key of [...this.needInputRetry.keys()]) {
+            const parsed = this.parseNeedInputRetryKey(key);
+            if (parsed && parsed.agentId === agentId && parsed.taskId === taskId) {
+                this.needInputRetry.delete(key);
+            }
+        }
+        this.ensureNeedInputRetryTimer();
+    }
+    ensureNeedInputRetryTimer() {
+        if (this.needInputRetry.size === 0) {
+            if (this.needInputRetryTimer) {
+                clearInterval(this.needInputRetryTimer);
+                this.needInputRetryTimer = null;
+            }
+            return;
+        }
+        if (this.needInputRetryTimer)
+            return;
+        this.needInputRetryTimer = setInterval(() => {
+            void this.needInputRetryPass();
+        }, this.needInputRetryIntervalMs);
+        this.needInputRetryTimer.unref?.();
+    }
+    async needInputRetryPass() {
+        for (const [key, snapshot] of [...this.needInputRetry.entries()]) {
+            if (this.needInputRetryInFlight.has(key))
+                continue;
+            const parsed = this.parseNeedInputRetryKey(key);
+            if (!parsed) {
+                this.needInputRetry.delete(key);
+                continue;
+            }
+            this.needInputRetryInFlight.add(key);
+            try {
+                const result = await this.writeNeedInputWatermark({
+                    agentId: parsed.agentId,
+                    taskId: parsed.taskId,
+                    epoch: parsed.epoch,
+                    askSeq: snapshot.askSeq,
+                    answeredSeq: snapshot.answeredSeq,
+                });
+                if (result !== 'error') {
+                    this.settleNeedInputRetry(key, snapshot.askSeq, snapshot.answeredSeq, result);
+                }
+            }
+            finally {
+                this.needInputRetryInFlight.delete(key);
+            }
+        }
+        this.ensureNeedInputRetryTimer();
+    }
+    collectSameEpochNeedInput(agentId, taskId, epoch) {
+        let owed = null;
+        const merge = (wm) => {
+            owed = {
+                askSeq: Math.max(owed?.askSeq ?? 0, wm.askSeq),
+                answeredSeq: Math.max(owed?.answeredSeq ?? 0, wm.answeredSeq),
+            };
+        };
+        for (const [key, wm] of this.needInputRetry) {
+            const parsed = this.parseNeedInputRetryKey(key);
+            if (!parsed || parsed.agentId !== agentId || parsed.taskId !== taskId)
+                continue;
+            if (parsed.epoch === epoch)
+                merge(wm);
+        }
+        for (const intent of this.needInputWritesInFlight.values()) {
+            if (intent.agentId !== agentId || intent.taskId !== taskId)
+                continue;
+            if (intent.epoch === epoch)
+                merge(intent);
+        }
+        return owed;
+    }
+    // Only the generation this arm directly succeeds (bumps are +1 and serialized per key).
+    // Anything older was already superseded — a fresh arm in between stripped its question
+    // on purpose, and transplanting it would relight a prompt nobody asked.
+    collectPredecessorNeedInputDelta(agentId, taskId, epoch) {
+        let delta = null;
+        const merge = (wm) => {
+            delta = {
+                askSeq: Math.max(delta?.askSeq ?? 0, wm.askSeq),
+                answeredSeq: Math.max(delta?.answeredSeq ?? 0, wm.answeredSeq),
+            };
+        };
+        for (const [key, wm] of this.needInputRetry) {
+            const parsed = this.parseNeedInputRetryKey(key);
+            if (!parsed || parsed.agentId !== agentId || parsed.taskId !== taskId)
+                continue;
+            if (parsed.epoch === epoch - 1)
+                merge(wm);
+        }
+        for (const intent of this.needInputWritesInFlight.values()) {
+            if (intent.agentId !== agentId || intent.taskId !== taskId)
+                continue;
+            if (intent.epoch === epoch - 1)
+                merge(intent);
+        }
+        return delta;
+    }
+    async withNeedInputArmLock(agentId, taskId, fn) {
+        const key = `${agentId} ${taskId}`;
+        const prev = this.needInputArmLocks.get(key) ?? Promise.resolve();
+        const run = prev.then(fn);
+        const settled = run.then(() => undefined, () => undefined);
+        this.needInputArmLocks.set(key, settled);
+        void settled.finally(() => {
+            if (this.needInputArmLocks.get(key) === settled)
+                this.needInputArmLocks.delete(key);
+        });
+        return run;
+    }
+    // 'restore' must also merge queued retry seqs of the CURRENT persisted epoch: after
+    // session-gone the queue can hold the only proof an answer happened (the entry is
+    // gone, so needInputInherit has nothing to merge), and the arm clears the queue.
+    async bumpNeedInputEpochForArm(agentId, taskId, mode, opts = {}) {
+        // Contributions are collected INSIDE the updater: it runs when the store chain
+        // reaches this bump, so an answer whose commit started while the bump was queued
+        // (registered in the ledger, or already error-queued) is still visible. A snapshot
+        // taken at call time would miss exactly that window.
+        const collectContributions = () => {
+            const queued = new Map();
+            if (mode !== 'restore')
+                return queued;
+            const mergeContribution = (epoch, wm) => {
+                const cur = queued.get(epoch);
+                queued.set(epoch, {
+                    askSeq: Math.max(cur?.askSeq ?? 0, wm.askSeq),
+                    answeredSeq: Math.max(cur?.answeredSeq ?? 0, wm.answeredSeq),
+                });
+            };
+            for (const [key, qwm] of this.needInputRetry) {
+                const parsed = this.parseNeedInputRetryKey(key);
+                if (!parsed || parsed.agentId !== agentId || parsed.taskId !== taskId)
+                    continue;
+                mergeContribution(parsed.epoch, qwm);
+            }
+            for (const intent of this.needInputWritesInFlight.values()) {
+                if (intent.agentId !== agentId || intent.taskId !== taskId)
+                    continue;
+                mergeContribution(intent.epoch, intent);
+            }
+            return queued;
+        };
+        let wm = null;
+        let snapshotBlind = false;
+        // Scoped to THIS arm's token: a marker left by another token's replay says nothing
+        // about the pane's ambiguity for us, so it is neither honoured nor carried forward.
+        const keepCutover = (cur) => (opts.paneCutover
+            ? opts.armToken
+            : cur !== undefined && cur.cutoverToken === opts.armToken ? cur.cutoverToken : undefined);
+        try {
+            await this.agentStore.update(agentId, (existing) => {
+                if (!existing || existing.taskId !== taskId)
                     return AGENT_STORE_NOOP;
-                const { needInputAt: _needInputAt, ...rest } = existing;
-                return { ...rest, updatedAt: now };
+                const cur = existing.needInput;
+                const contrib = collectContributions().get(cur?.epoch ?? 0);
+                const epoch = (cur?.epoch ?? 0) + 1;
+                const askSeq = mode === 'restore' ? Math.max(cur?.askSeq ?? 0, contrib?.askSeq ?? 0) : 0;
+                const answeredSeq = mode === 'restore'
+                    ? Math.max(cur?.answeredSeq ?? 0, contrib?.answeredSeq ?? 0)
+                    : 0;
+                wm = { epoch, askSeq, answeredSeq };
+                const cutoverToken = keepCutover(cur);
+                snapshotBlind = cutoverToken !== undefined;
+                const at = askSeq > answeredSeq ? (cur?.at ?? new Date().toISOString()) : undefined;
+                return {
+                    ...existing,
+                    needInput: {
+                        epoch, askSeq, answeredSeq,
+                        ...(at !== undefined ? { at } : {}),
+                        ...(cutoverToken !== undefined ? { cutoverToken } : {}),
+                    },
+                    updatedAt: new Date().toISOString(),
+                };
             });
         }
         catch (err) {
-            console.warn(`[AgentManager] setAgentNeedInput(${agentId}, ${pending}) failed:`, err);
+            console.warn(`[AgentManager] needInput epoch bump failed (agent=${agentId} task=${taskId}):`, err);
+            // Fall back to the persisted watermark for a restore: without it the entry would
+            // start at 0/0 and swallow the answer to a question that is still open in the
+            // store, leaving the badge lit forever. No bump means no generation advance —
+            // the caller must not treat this as a fresh generation.
+            if (mode === 'restore') {
+                try {
+                    const cur = await this.agentStore.get(agentId);
+                    if (cur?.taskId === taskId && cur.needInput) {
+                        // Same-generation intents still owed to the store hold questions the
+                        // persisted watermark has not caught up with; merge them in.
+                        const owed = this.collectSameEpochNeedInput(agentId, taskId, cur.needInput.epoch);
+                        return {
+                            wm: {
+                                epoch: cur.needInput.epoch,
+                                askSeq: Math.max(cur.needInput.askSeq ?? 0, owed?.askSeq ?? 0),
+                                answeredSeq: Math.max(cur.needInput.answeredSeq ?? 0, owed?.answeredSeq ?? 0),
+                            },
+                            bumped: false,
+                            snapshotBlind: cur.needInput.cutoverToken === opts.armToken,
+                        };
+                    }
+                }
+                catch (readErr) {
+                    console.warn(`[AgentManager] needInput watermark read-back failed (agent=${agentId}):`, readErr);
+                }
+            }
+            return { wm: null, bumped: false, snapshotBlind: true };
         }
+        return { wm, bumped: wm !== null, snapshotBlind: wm === null ? true : snapshotBlind };
     }
-    // Single entry for arming phase-signal watches: every path (dispatch, post-approve,
-    // recover, rollback) must carry the need-input callback, or that watch silently
-    // drops the side-channel and the badge never lights for its phase.
-    startPhaseSignalWatch(args) {
+    // Single entry for arming phase-signal watches — every path must flow through the
+    // epoch bump, or stale-generation commits could survive the re-arm.
+    async startPhaseSignalWatch(args) {
         if (!this.phaseSignalWatcher)
-            return Promise.resolve(true);
-        return this.phaseSignalWatcher.start({
-            ...args,
-            onNeedInput: (pending) => {
-                void this.setAgentNeedInput(args.agentId, pending, { taskId: args.taskId });
-            },
+            return true;
+        const { needInputMode, needInputPaneCutover: _paneCutover, ...rest } = args;
+        const mode = needInputMode ?? 'restore';
+        const watcher = this.phaseSignalWatcher;
+        // Claim ownership before bumping: a rejected arm must not bump (it would fence the
+        // owner), and the claim keeps this arm visible to later probes while it subscribes.
+        const gateResult = await this.withNeedInputArmLock(args.agentId, args.taskId, async () => {
+            const claim = watcher.claimArm?.({
+                taskId: args.taskId,
+                agentId: args.agentId,
+                token: args.token,
+                ...(args.onlyReplaceOwnToken !== undefined ? { onlyReplaceOwnToken: args.onlyReplaceOwnToken } : {}),
+                ...(args.replaceScope !== undefined ? { replaceScope: args.replaceScope } : {}),
+            });
+            if (claim === null)
+                return 'rejected';
+            const bump = await this.bumpNeedInputEpochForArm(args.agentId, args.taskId, mode, {
+                armToken: args.token,
+                ...(args.needInputPaneCutover ? { paneCutover: true } : {}),
+            });
+            // Only a real generation advance may drop the queue: same-generation intents
+            // (bump failed, watermark read back) are still owed to the store.
+            if (bump.bumped)
+                this.clearNeedInputRetryFor(args.agentId, args.taskId);
+            return { ...bump, claim };
         });
+        if (gateResult === 'rejected')
+            return false;
+        const { wm, bumped, snapshotBlind, claim } = gateResult;
+        // Same synchronous section as the bump result: old-generation answers must not slip
+        // between the bump and the handoff (start() migrates the predecessor synchronously).
+        if (wm !== null && bumped && mode === 'restore') {
+            const delta = this.collectPredecessorNeedInputDelta(args.agentId, args.taskId, wm.epoch);
+            if (delta) {
+                void this.commitNeedInputWatermark({
+                    agentId: args.agentId,
+                    taskId: args.taskId,
+                    epoch: wm.epoch,
+                    askSeq: Math.max(delta.askSeq, wm.askSeq),
+                    answeredSeq: Math.max(delta.answeredSeq, wm.answeredSeq),
+                });
+            }
+        }
+        // wm === null (no binding / store error): arm anyway with badge commits disabled —
+        // the badge is display-only, the signal watch drives task progress.
+        try {
+            return await watcher.start({
+                ...rest,
+                ...(claim != null ? { armClaimId: claim } : {}),
+                // Inherit is about restore semantics, not about having a generation: a degraded
+                // restore still has to keep the predecessor's pending question in memory.
+                needInputInherit: mode === 'restore',
+                ...(snapshotBlind ? { needInputSnapshotBlind: true } : {}),
+                ...(wm !== null ? { needInput: wm } : {}),
+            });
+        }
+        finally {
+            watcher.releaseArm?.(claim);
+        }
+    }
+    // Web-fallback confirm: settles the newest known question (store ∪ retry queue) as
+    // answered in ONE store update — usable when no watch entry exists (pre-recovery,
+    // arm failure, post-stop). Queue contributions are snapshotted synchronously; the
+    // updater derives everything else from `existing`, so no nested store calls.
+    async confirmNeedInputAnswered(agentId) {
+        const queueAsk = new Map();
+        for (const [key, wm] of this.needInputRetry) {
+            const parsed = this.parseNeedInputRetryKey(key);
+            if (!parsed || parsed.agentId !== agentId)
+                continue;
+            const mapKey = `${parsed.taskId} ${parsed.epoch}`;
+            queueAsk.set(mapKey, Math.max(queueAsk.get(mapKey) ?? 0, wm.askSeq));
+        }
+        for (const intent of this.needInputWritesInFlight.values()) {
+            if (intent.agentId !== agentId)
+                continue;
+            const mapKey = `${intent.taskId} ${intent.epoch}`;
+            queueAsk.set(mapKey, Math.max(queueAsk.get(mapKey) ?? 0, intent.askSeq));
+        }
+        let settled = null;
+        try {
+            await this.agentStore.update(agentId, (existing) => {
+                if (!existing?.taskId)
+                    return AGENT_STORE_NOOP;
+                const cur = existing.needInput;
+                const epoch = cur?.epoch ?? 0;
+                const qAsk = queueAsk.get(`${existing.taskId} ${epoch}`) ?? 0;
+                const askSeq = Math.max(cur?.askSeq ?? 0, qAsk);
+                const answeredSeq = Math.max(cur?.answeredSeq ?? 0, askSeq);
+                settled = { taskId: existing.taskId, epoch, askSeq };
+                if (cur && (cur.askSeq ?? 0) === askSeq && (cur.answeredSeq ?? 0) === answeredSeq && cur.at === undefined) {
+                    return AGENT_STORE_NOOP;
+                }
+                if (!cur && askSeq === 0)
+                    return AGENT_STORE_NOOP;
+                return {
+                    ...existing,
+                    needInput: {
+                        epoch, askSeq, answeredSeq,
+                        ...(cur?.cutoverToken !== undefined ? { cutoverToken: cur.cutoverToken } : {}),
+                    },
+                    updatedAt: new Date().toISOString(),
+                };
+            });
+        }
+        catch (err) {
+            console.warn(`[AgentManager] confirmNeedInputAnswered(${agentId}) failed:`, err);
+            if (settled !== null) {
+                const s = settled;
+                this.enqueueNeedInputRetry(this.needInputRetryKey(agentId, s.taskId, s.epoch), s.askSeq, s.askSeq);
+            }
+            return;
+        }
+        if (settled !== null) {
+            const s = settled;
+            this.settleNeedInputRetry(this.needInputRetryKey(agentId, s.taskId, s.epoch), s.askSeq, s.askSeq, 'ok');
+        }
     }
-    // The user typed into the agent's terminal — its pending question is being answered.
+    // The user typed into the agent's terminal — its open question counts as answered.
+    // The store fallback runs only when no watch entry exists (pre-recovery, arm failure,
+    // post-stop): with a live entry it would race the entry's in-flight writes and could
+    // confirm an ask that arrived after this input.
     async notifyHumanTerminalInput(agentId) {
-        this.phaseSignalWatcher?.rearmNeedInput(agentId);
-        await this.setAgentNeedInput(agentId, false);
+        // Rearm first: it settles entry state synchronously, so a question printed during
+        // this call cannot be confirmed by mistake. The binding read only decides whether a
+        // watcher of the CURRENT task took the input — a leftover entry of a finished task
+        // must not suppress the store fallback.
+        const handled = await this.phaseSignalWatcher?.rearmNeedInput(agentId);
+        let taskId;
+        try {
+            taskId = (await this.agentStore.get(agentId))?.taskId;
+        }
+        catch (err) {
+            console.warn(`[AgentManager] notifyHumanTerminalInput(${agentId}) binding read failed:`, err);
+        }
+        if (taskId === undefined || !handled?.has(taskId))
+            await this.confirmNeedInputAnswered(agentId);
     }
     async clearAwaitingHuman(agentId, opts = {}) {
         const now = new Date().toISOString();
@@ -2308,6 +2892,8 @@ export class AgentManager {
                         next.lockToken = existing.lockToken;
                     if (existing.startedAt !== undefined)
                         next.startedAt = existing.startedAt;
+                    if (existing.needInput !== undefined)
+                        next.needInput = existing.needInput;
                 }
                 return next;
             });
@@ -2398,10 +2984,18 @@ export class AgentManager {
         }
         if (result.redispatchReviewTaskId) {
             try {
+                const reviewTask = await this.taskStore.get(result.redispatchReviewTaskId);
+                const resumeEntry = this.getPendingDispatchRetry(result.redispatchReviewTaskId);
+                const resumeQaPhase = resumeEntry?.kind === 'qa-recheck'
+                    && resumeEntry.signalToken === reviewTask?.signalToken
+                    && resumeEntry.qaPhase !== undefined
+                    ? resumeEntry.qaPhase
+                    : (reviewTask?.reviewRound === 0 ? 'review' : undefined);
                 await this.dispatchReviewToQa(result.redispatchReviewTaskId, {
-                    bumpRound: false,
+                    bumpRound: reviewTask?.reviewRoundPending === true,
                     fromStatus: ['review'],
                     ...(result.reviewPassToken !== undefined ? { expectSignalToken: result.reviewPassToken } : {}),
+                    ...(resumeQaPhase !== undefined ? { qaPhase: resumeQaPhase } : {}),
                 });
             }
             catch (err) {
@@ -2496,14 +3090,12 @@ export class AgentManager {
             ...(result.reason ? { reason: result.reason } : {}),
         };
     }
-    async resolvePaneId(state, cfg) {
-        if (state.paneId)
-            return state.paneId;
+    async resolveClaimedPaneOrNull(state, cfg) {
         try {
-            return await new TmuxManager(this.createRunnerFor(cfg)).getSinglePaneId(cfg.id);
+            return await this.resolveClaimedPane(new TmuxManager(this.createRunnerFor(cfg)), cfg.id, state.paneId);
         }
         catch (err) {
-            console.warn(`[AgentManager] resolvePaneId: getSinglePaneId failed for ${cfg.id}:`, err);
+            console.warn(`[AgentManager] resolveClaimedPane failed for ${cfg.id}:`, err);
             return null;
         }
     }
@@ -2521,27 +3113,16 @@ export class AgentManager {
         }
         if (!sessionAlive)
             return { kind: 'absent' };
-        let claim;
         try {
-            claim = await tmux.getOption(agentId, '@baxian-agent-id');
-        }
-        catch (err) {
-            return {
-                kind: 'hold',
-                reason: `Runtime session claim probe failed; refusing checkout cleanup: ` +
-                    `${err instanceof Error ? err.message : String(err)}`,
-            };
-        }
-        if (claim !== agentId) {
-            return {
-                kind: 'hold',
-                reason: `Runtime session claim mismatch (got "${claim ?? 'null'}"); refusing checkout cleanup`,
-            };
-        }
-        try {
-            return { kind: 'pane', paneId: await tmux.getSinglePaneId(agentId) };
+            return { kind: 'pane', pane: await this.resolveClaimedPane(tmux, agentId) };
         }
         catch (err) {
+            if (err instanceof PaneGoneError) {
+                return {
+                    kind: 'hold',
+                    reason: `Runtime session claim probe/mismatch; refusing checkout cleanup: ${err.message}`,
+                };
+            }
             return {
                 kind: 'hold',
                 reason: `Runtime pane probe failed; refusing checkout cleanup: ` +
@@ -2550,9 +3131,10 @@ export class AgentManager {
         }
     }
     async interruptPaneAndWaitReady(state, cfg) {
-        const paneId = await this.resolvePaneId(state, cfg);
-        if (!paneId)
+        const pane = await this.resolveClaimedPaneOrNull(state, cfg);
+        if (!pane)
             return false;
+        const paneId = pane.paneId;
         const tmux = new TmuxManager(this.createRunnerFor(cfg));
         const runtime = agentRuntimeKindFor(cfg);
         if (!(await this.acquireCompactGuardWithin(cfg.id, this.cancelInterruptGuardWaitMs))) {
@@ -2563,43 +3145,44 @@ export class AgentManager {
         }
         try {
             try {
-                await tmux.sendKeysToPane(paneId, 'Escape');
+                await tmux.sendKeysToPane(pane, 'Escape');
                 await new Promise(r => setTimeout(r, 200));
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: send Escape failed for pane ${paneId}:`, err);
                 return false;
             }
-            if (await this.paneReachedReplReady(tmux, paneId, runtime, 10_000))
+            if (await this.paneReachedReplReady(tmux, pane, runtime, 10_000))
                 return true;
-            if (!(await this.paneRunsRuntime(tmux, paneId, runtime)))
+            if (!(await this.paneRunsRuntime(tmux, pane, runtime)))
                 return false;
-            if (await this.paneHasLiveTurn(tmux, paneId, runtime)) {
+            if (await this.paneHasLiveTurn(tmux, pane, runtime)) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: pane ${paneId} still running a turn after ESC; holding`);
                 return false;
             }
-            if (!(await this.paneRunsRuntime(tmux, paneId, runtime)))
+            if (!(await this.paneRunsRuntime(tmux, pane, runtime)))
                 return false;
             try {
-                await tmux.sendKeysToPane(paneId, 'C-c');
+                await tmux.sendKeysToPane(pane, 'C-c');
                 await new Promise(r => setTimeout(r, 200));
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: send C-c (composer clear) failed for pane ${paneId}:`, err);
                 return false;
             }
-            return this.paneReachedReplReady(tmux, paneId, runtime, this.cleanComposerWaitMs);
+            return this.paneReachedReplReady(tmux, pane, runtime, this.cleanComposerWaitMs);
         }
         finally {
             this.compactInFlight.delete(cfg.id);
         }
     }
-    async paneHasLiveTurn(tmux, paneId, runtime) {
+    async paneHasLiveTurn(tmux, pane, runtime) {
+        const paneId = pane.paneId;
         let first;
         let firstTitle;
         try {
-            first = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
-            firstTitle = await tmux.readPaneTitle(paneId);
+            first = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+            firstTitle = await tmux.readPaneTitle(pane);
         }
         catch (err) {
             console.warn(`[AgentManager] interruptPaneAndWaitReady: liveness capture failed for pane ${paneId}:`, err);
@@ -2610,8 +3193,8 @@ export class AgentManager {
             let frame;
             let title;
             try {
-                frame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
-                title = await tmux.readPaneTitle(paneId);
+                frame = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+                title = await tmux.readPaneTitle(pane);
             }
             catch (err) {
                 console.warn(`[AgentManager] interruptPaneAndWaitReady: liveness re-capture failed for pane ${paneId}:`, err);
@@ -2626,10 +3209,11 @@ export class AgentManager {
         }
         return false;
     }
-    async paneRunsRuntime(tmux, paneId, runtime) {
+    async paneRunsRuntime(tmux, pane, runtime) {
+        const paneId = pane.paneId;
         let proc;
         try {
-            proc = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            proc = await tmux.displayMessage(pane, '#{pane_current_command}');
         }
         catch (err) {
             console.warn(`[AgentManager] interruptPaneAndWaitReady: proc-title read failed for pane ${paneId}:`, err);
@@ -2641,9 +3225,10 @@ export class AgentManager {
         }
         return true;
     }
-    async paneReachedReplReady(tmux, paneId, runtime, timeoutMs) {
+    async paneReachedReplReady(tmux, pane, runtime, timeoutMs) {
+        const paneId = pane.paneId;
         try {
-            await tmux.waitReplReady(paneId, runtime, { timeoutMs, scrollback: 0, titleIdleFastPath: true });
+            await tmux.waitReplReady(pane, runtime, { timeoutMs, scrollback: 0, titleIdleFastPath: true });
             return true;
         }
         catch (err) {
@@ -2774,20 +3359,25 @@ export class AgentManager {
             }
         }
     }
-    async pollPaneCommandStable(tmux, paneId, opts) {
+    async pollPaneCommandStable(tmux, pane, opts) {
         const deadline = Date.now() + opts.timeoutMs;
         const SHELL = /^(?:zsh|bash|sh|fish)$/;
         let last = '';
         while (Date.now() < deadline) {
             await new Promise(r => setTimeout(r, 100));
-            const raw = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            const raw = await tmux.displayMessage(pane, '#{pane_current_command}');
             last = raw.trim();
             if (opts.expectShell ? SHELL.test(last) : last !== '')
                 return last;
         }
         return last;
     }
-    async restartReplOnly(agentId) {
+    async restartReplOnly(agentId, opts = {}) {
+        // Re-verify the entry generation so a request that slept across a DELETE→recreate can't restart the NEW incarnation's REPL (claim check alone can't tell).
+        const genAtEntry = opts.expectedGeneration ?? this.deletionGenerationOf(agentId);
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`Unknown agent: ${agentId}`);
@@ -2800,14 +3390,17 @@ export class AgentManager {
         if (snapshot.claim !== agentId) {
             throw new Error(`restart-repl: session claim mismatch (got "${snapshot.claim ?? 'null'}"); refusing to touch foreign session`);
         }
-        const paneId = await tmux.getSinglePaneIdByRef(snapshot.ref);
-        await tmux.sendKeysToPane(paneId, 'C-c');
-        const cmd = await this.pollPaneCommandStable(tmux, paneId, { timeoutMs: 2_000 });
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
+        const pane = await tmux.getSinglePaneByRef(snapshot.ref, agentId);
+        await tmux.sendKeysToPane(pane, 'C-c');
+        const cmd = await this.pollPaneCommandStable(tmux, pane, { timeoutMs: 2_000 });
         const RUNTIME = /^(?:claude|codex|node|opencode|qodercli(?:-[\d.]+)?|\d+\.\d+\.\d+)$/;
         const SHELL = /^(?:zsh|bash|sh|fish)$/;
         if (RUNTIME.test(cmd)) {
-            await tmux.sendKeysToPane(paneId, REPL_EXIT_COMMAND[cfg.runtime], 'Enter');
-            await this.pollPaneCommandStable(tmux, paneId, { timeoutMs: 2_000, expectShell: true });
+            await tmux.sendKeysToPane(pane, REPL_EXIT_COMMAND[cfg.runtime], 'Enter');
+            await this.pollPaneCommandStable(tmux, pane, { timeoutMs: 2_000, expectShell: true });
         }
         else if (!SHELL.test(cmd)) {
             throw new Error(`restart-repl precondition failed: unexpected pane state "${cmd}"`);
@@ -2815,33 +3408,42 @@ export class AgentManager {
         const project = this.getProjectConfig(cfg.projectId);
         if (!project)
             throw new Error(`restart-repl: project ${cfg.projectId} does not exist`);
+        // Re-verify before Workdir/skill/session-option side-effects: pane writes fail-closed on a stale PaneRef, but ensureWorkdir/skills would write old-cfg files under a recreated id.
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         const workdir = (await this.ensureWorkdir(cfg, project, runner)).workdir;
-        const paneWorkdir = await tmux.getPaneCurrentPath(paneId);
+        const paneWorkdir = await tmux.getPaneCurrentPath(pane);
         if (!await sameDirOnHost(runner, paneWorkdir, workdir)) {
             throw new Error(`restart-repl: pane Workdir ${paneWorkdir} does not match agent Workdir ${workdir}; ` +
                 'use retry to rebuild the session safely');
         }
+        if (!this.deletionGateOpen(agentId, genAtEntry)) {
+            throw new Error(`restart-repl: agent ${agentId} is being deleted or was recreated; aborting`);
+        }
         await this.provisionRepoSkills(runner, cfg, workdir);
         await this.setSessionOptions(tmux, agentId, snapshot.ref, [[WORKDIR_SESSION_OPTION, workdir]]);
         const runtime = agentRuntimeKindFor(cfg);
         const relaunch = async () => {
-            await tmux.sendKeysToPane(paneId, `${launchCommandIn(workdir, cfg)}\n`);
-            await tmux.handleTrustDialog(paneId, runtime, {
+            await tmux.sendKeysLiteral(pane, launchCommandIn(workdir, cfg));
+            await tmux.sendEnter(pane);
+            await tmux.handleTrustDialog(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.trustDialog,
             });
-            await tmux.waitReplReady(paneId, runtime, {
+            await tmux.waitReplReady(pane, runtime, {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
             await this.tagSessionSkillsVersion(tmux, agentId, snapshot.ref);
         };
         await this.runUnderSkillDirLock(this.skillDirLockKey(cfg, workdir), relaunch);
+        // Final writeback is generation-gated too, so a DELETE→recreate reusing %0 can't persist the old incarnation's paneId onto the new agent.
         await this.agentStore.update(agentId, (state) => {
-            if (!state)
+            if (!state || !this.deletionGateOpen(agentId, genAtEntry))
                 return AGENT_STORE_NOOP;
             return {
                 ...state,
-                paneId,
+                paneId: pane.paneId,
                 updatedAt: new Date().toISOString(),
             };
         });
@@ -2920,6 +3522,8 @@ export class AgentManager {
                     const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
                         skipSnapshot: true,
                         onlyReplaceOwnToken: true,
+                        needInputMode: 'fresh',
+                        needInputPaneCutover: true,
                         // git 双 watcher 下 fence 只应比较自己的 (taskId, agentId) 条目：task 域会拿
                         // sibling（reconciliation）的不同 token 否决本应合法的重布防
                         ...(task.reviewMode === 'git' ? { replaceScope: 'agent' } : {}),
@@ -3217,25 +3821,11 @@ export class AgentManager {
         const failures = [];
         for (const id of targets) {
             const cfg = this.getAgentConfig(id);
-            if (!cfg)
-                continue;
-            const runner = this.createRunnerFor(cfg);
-            const tmux = new TmuxManager(runner);
-            const boundState = await this.agentStore.get(id);
-            if (boundState?.taskId) {
-                try {
-                    const released = await this.releaseAgentForTask(id, boundState.taskId, 'idle', {
-                        allowAwaitingHuman: true,
-                    });
-                    if (!released) {
-                        throw new Error(`could not safely release task ${boundState.taskId}`);
-                    }
-                }
-                catch (err) {
-                    failures.push({ agentId: id, step: 'binding.release', error: err });
-                    continue;
-                }
-            }
+            if (!cfg)
+                continue;
+            const runner = this.createRunnerFor(cfg);
+            const tmux = new TmuxManager(runner);
+            // No releaseAgentForTask: the binding dies with the state file in phase 3, and deletability was already enforced by the phase-1 API gates — so cleanup only stops watchers and kills the session.
             this.stopRuntimeMenuWatch(id);
             if (this.paneStreamerManager) {
                 try {
@@ -3247,21 +3837,45 @@ export class AgentManager {
             }
             try {
                 await this.runUnderSessionLifecycle(id, async () => {
-                    const snapshot = await tmux.getSessionSnapshot(id);
+                    const cleanupOpts = { timeout: DELETE_CLEANUP_TIMEOUT_MS };
+                    const snapshot = await tmux.getSessionSnapshot(id, cleanupOpts);
                     if (!snapshot)
                         return;
-                    if (snapshot.claim !== id) {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping kill for ${id} ` +
-                            `(claim=${snapshot.claim ?? 'null'}; not baxian-managed)`);
+                    if (snapshot.claim === id) {
+                        const outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'equals', claim: id }, cleanupOpts);
+                        if (outcome === 'refused') {
+                            throw new Error(`tmux generation/claim changed for ${id} before kill; retry DELETE to observe new state`);
+                        }
+                        if (outcome === 'killed') {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed session ${snapshot.ref.sessionId} for removed agent ${id}`);
+                        }
                         return;
                     }
-                    const outcome = await tmux.killSessionRef(snapshot.ref);
-                    if (outcome === 'stale-server') {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: tmux server generation changed for ${id} — leaving session untouched`);
-                    }
-                    else if (outcome === 'killed') {
-                        console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed session ${snapshot.ref.sessionId} for removed agent ${id}`);
+                    if (snapshot.claim === null) {
+                        // A nonce-owned unclaimed session is this project's own half-created leftover — reclaim it.
+                        let nonceOwned;
+                        try {
+                            nonceOwned = await tmux.hasCreationNonce(id, cleanupOpts);
+                        }
+                        catch (err) {
+                            throw new Error(`creation-nonce probe failed for ${id}; retry DELETE: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        if (!nonceOwned) {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping ${id} ` +
+                                `(unclaimed, no baxian creation nonce; foreign session)`);
+                            return;
+                        }
+                        const outcome = await tmux.killSessionRef(snapshot.ref, { kind: 'unclaimed' }, cleanupOpts);
+                        if (outcome === 'refused') {
+                            throw new Error(`half-created session for ${id} was claimed or its server changed before kill; retry DELETE`);
+                        }
+                        if (outcome === 'killed') {
+                            console.warn(`[AgentManager] cleanupRemovedAgentRuntime: killed half-created leftover ${snapshot.ref.sessionId} for removed agent ${id}`);
+                        }
+                        return;
                     }
+                    console.warn(`[AgentManager] cleanupRemovedAgentRuntime: skipping kill for ${id} ` +
+                        `(claim=${snapshot.claim}; not baxian-managed)`);
                 });
             }
             catch (err) {
@@ -3451,6 +4065,7 @@ export class AgentManager {
                 agentId: task.agentId,
                 expectedKinds: 'pr-merge-ready',
                 token: value.token,
+                needInputMode: 'fresh',
             });
             if (!armed) {
                 // completion 没有 consumer 就不算安装成功：撤销本次写，durable pending（若有）随原状保留
@@ -3752,6 +4367,30 @@ export class AgentManager {
     }
     // 配置身份切换与任务创建共栅栏（TOCTOU）：blocker 扫描与提交在 withTaskLock 内执行，
     // createTask 的「读配置快照+落任务」同经该锁，扫描时不可见的并发新任务不存在。
+    // 启动期按「未引用」跳过 skill 池的插件，被热配置首次引用时同步重扫；仍不可物化即拒绝提交——
+    // 可解析但物化为空的 tool 会让派发要求加载一个不存在的 skill。
+    async ensurePluginSkillPools(next) {
+        if (!this.pluginRegistry)
+            return;
+        for (const project of next.project) {
+            if (projectReviewMode(next, project) !== 'git')
+                continue;
+            const tool = resolveProjectTool(project);
+            if (tool === undefined)
+                continue;
+            const plugin = this.pluginRegistry.resolveTool(tool);
+            // 静默放行会存下一个「无 driver、无平台 skill、重启即 fatal」的配置（启动期同判据）
+            if (plugin === undefined) {
+                throw new Error(`project '${project.id}': no git-driver plugin provides tool '${tool}' — install it under ~/.baxian/plugins/ first`);
+            }
+            if (this.skillRegistry.pluginSkillNames({ pluginTools: [tool] }).length > 0)
+                continue;
+            await this.skillRegistry.scanPluginSkills(tool, join(plugin.pluginPath, 'skills'));
+            if (this.skillRegistry.pluginSkillNames({ pluginTools: [tool] }).length === 0) {
+                throw new Error(`plugin '${plugin.manifest.name}' provides no materializable skills for tool '${tool}'`);
+            }
+        }
+    }
     async guardGitConfigCommit(current, next, scan, commit) {
         return this.withTaskLock(async () => {
             const blockers = await scan(this, current, next);
@@ -3801,7 +4440,27 @@ export class AgentManager {
             if (!['review', 'in_progress', 'fixing'].includes(task.status))
                 continue;
             try {
-                await this.dispatchReviewToQa(task.id, { bumpRound: false });
+                // 列表是旧快照：消费谓词按实时值复核（pending 仍在 + 状态允许），并把代际
+                // CAS（expectSignalToken + expectReviewDispatchPending）压进 dispatch 锁内
+                const live = await this.taskStore.get(task.id);
+                if (!live || live.reviewDispatchPending !== true)
+                    continue;
+                if (!['review', 'in_progress', 'fixing'].includes(live.status))
+                    continue;
+                const entry = this.getPendingDispatchRetry(live.id);
+                if (entry?.kind === 'qa-recheck' && entry.signalToken === live.signalToken) {
+                    // 同代 busy pending 在场：QA 已知忙碌，重派只会空转 release/acquire 并重置预算；
+                    // 交给对账的观测门在空闲后消费
+                    continue;
+                }
+                const qaPhase = live.reviewRound === 0 ? 'review' : undefined;
+                await this.dispatchReviewToQa(live.id, {
+                    bumpRound: live.reviewRoundPending === true,
+                    ...(qaPhase !== undefined ? { qaPhase } : {}),
+                    ...(live.signalToken !== undefined ? { expectSignalToken: live.signalToken } : {}),
+                    expectReviewDispatchPending: true,
+                    fromStatus: ['review', 'in_progress', 'fixing'],
+                });
             }
             catch (err) {
                 console.warn(`[AgentManager] retryPendingGitReviewDispatches: task=${task.id} still failing:`, err);
@@ -4153,6 +4812,82 @@ export class AgentManager {
             return {};
         return { platformBinding: { mode: 'git', repoKey: repoIdentityKey(project.repo), tool } };
     }
+    // agent 面一律 PATH 解析 tool；server 面 binary/env 不进入该轨。
+    agentGitPreflightContext(projectId) {
+        if (this.effectiveReviewMode(projectId) !== 'git')
+            return undefined;
+        const project = this.getProjectConfig(projectId);
+        if (!project || !this.pluginRegistry)
+            return undefined;
+        const tool = resolveProjectTool(project);
+        if (tool === undefined)
+            return undefined;
+        const plugin = this.pluginRegistry.resolveTool(tool);
+        if (plugin === undefined)
+            return undefined;
+        const renderCtx = buildDriverRunContext(project.repo, tool);
+        return {
+            tool,
+            minToolVersion: plugin.manifest.minToolVersion,
+            steps: plugin.spec.preflight,
+            agentCommands: plugin.spec.agentCommands,
+            renderCtx,
+            driverFor: (exec) => new GitDriver(plugin, renderCtx, exec),
+        };
+    }
+    // cli 字段族每次派发实时渲染，不做创建时快照。渲染前按持久化 binding 校验身份——
+    // 离线漂移的配置会把旧任务的 PR 号/分支/令牌带到新仓库，与平台操作同一守卫。
+    platformCliContextOf(task) {
+        if (task.reviewMode !== 'git')
+            return undefined;
+        this.assertPlatformBinding(task);
+        const project = this.getProjectConfig(task.projectId);
+        if (!project)
+            return undefined;
+        const tool = resolveProjectTool(project);
+        if (tool === undefined)
+            return undefined;
+        const ctx = buildDriverRunContext(project.repo, tool);
+        return {
+            tool,
+            host: ctx.host,
+            repo: ctx.repoPath,
+            repoEncoded: encodeURIComponent(ctx.repoPath),
+            ...(project.gitCli?.notes !== undefined ? { notes: project.gitCli.notes } : {}),
+        };
+    }
+    // base 快照一经持久化不可变；无快照保持缺省，由 agent 现场显式查询。
+    async ensureGitBaseSnapshot(task, phase) {
+        if (task.reviewMode !== 'git' || (phase !== 'develop' && phase !== 'code'))
+            return task;
+        if (task.baseBranch !== undefined)
+            return task;
+        // 读默认分支与落快照都以 binding 为前提：失配任务先写入新仓库的 base 会永久污染不可变快照
+        this.assertPlatformBinding(task);
+        const base = this.platformDefaultBranchOf?.(task.projectId);
+        if (base === undefined)
+            return task;
+        return this.withTaskLock(async () => {
+            const fresh = await this.taskStore.get(task.id);
+            if (!fresh)
+                return task;
+            if (fresh.baseBranch !== undefined)
+                return fresh;
+            this.assertPlatformBinding(fresh);
+            const next = { ...fresh, baseBranch: base, updatedAt: new Date().toISOString() };
+            await this.taskStore.set(next);
+            return next;
+        });
+    }
+    async noteReviewConversationRevision(taskId) {
+        await this.withTaskLock(async () => {
+            const task = await this.taskStore.get(taskId);
+            if (!task || TERMINAL_STATUSES.includes(task.status))
+                return;
+            const now = new Date().toISOString();
+            await this.taskStore.set({ ...task, reviewConversationUpdatedAt: now, updatedAt: now });
+        });
+    }
     // 指纹为纯身份三元组（spec §4）：binary/env/skill 文本 live 解析可演进，身份失配即拒绝
     assertPlatformBinding(task) {
         const binding = task.platformBinding;
@@ -4461,16 +5196,21 @@ export class AgentManager {
             return { task, previousStatus };
         });
     }
-    async bumpReviewRoundIfStillAt(taskId, expectedRound) {
+    // 送达即计轮：flag 是唯一入账凭据，与 verdict 公式（round + flag）按 token CAS 互斥消费，
+    // successor 换代或 verdict 先行都自然跳过，恰好一次
+    // 不设终态守卫：只写轮次不写 status（无复活风险），而终态任务的 recheck 派发是受支持的能力，
+    // 其送达的轮次同样要入账
+    async consumeReviewRoundIntent(taskId, expectedToken) {
         await this.withTaskLock(async () => {
-            const task = await this.taskStore.get(taskId);
-            if (!task || TERMINAL_STATUSES.includes(task.status))
-                return;
-            if ((task.reviewRound ?? 0) !== expectedRound)
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh || fresh.signalToken !== expectedToken || fresh.reviewRoundPending !== true)
                 return;
-            task.reviewRound = expectedRound + 1;
-            task.updatedAt = new Date().toISOString();
-            await this.taskStore.set(task);
+            await this.taskStore.set({
+                ...fresh,
+                reviewRound: fresh.reviewRound + 1,
+                reviewRoundPending: undefined,
+                updatedAt: new Date().toISOString(),
+            });
         });
     }
     createRunnerFor(agent) {
@@ -4484,7 +5224,10 @@ export class AgentManager {
         if (this.repoStoreFactory) {
             return this.repoStoreFactory(runner, project.repo, agent.mode, host, this.repoCache, agent.id, agent.workdir);
         }
-        return new RepoStore(runner, project.repo, agent.mode, host, this.repoCache, agent.id, agent.workdir);
+        const cloneViaGh = this.effectiveReviewMode(project.id) === 'git'
+            ? resolveProjectTool(project) === 'gh'
+            : undefined;
+        return new RepoStore(runner, project.repo, agent.mode, host, this.repoCache, agent.id, agent.workdir, cloneViaGh);
     }
     async ensureWorkdir(agent, project, runner) {
         const repoStore = this.createRepoStore(agent, project, runner);
@@ -4500,6 +5243,9 @@ export class AgentManager {
         return this.repoCache;
     }
     async rollbackFailedDispatch(taskId, agentId, reason, expectedLockToken) {
+        // Pin the incarnation: task rollback / intervention below await, and a DELETE→same-id recreate in that
+        // window must not let the final state write-back resurrect the deleted agent.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const existing = await this.agentStore.get(agentId);
         if (existing && existing.taskId !== undefined && existing.taskId !== taskId) {
             console.warn(`[AgentManager] rollback: agent ${agentId} taskId mismatch (expected ${taskId}, got ${existing.taskId}); ` +
@@ -4546,12 +5292,16 @@ export class AgentManager {
         else {
             const now = new Date().toISOString();
             await this.agentStore.update(agentId, (latest) => {
-                if (latest?.taskId === taskId && latest.lockToken !== expectedLockToken)
+                // Never resurrect a deleted/recreated incarnation: if the state is gone or the generation moved
+                // since entry, this rollback is stale — clear nothing rather than rebuild from the old snapshot.
+                if (!latest || !this.deletionGateOpen(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
+                if (latest.taskId === taskId && latest.lockToken !== expectedLockToken)
                     return AGENT_STORE_NOOP;
-                if (latest?.taskId !== undefined && latest.taskId !== taskId)
+                if (latest.taskId !== undefined && latest.taskId !== taskId)
                     return AGENT_STORE_NOOP;
                 return {
-                    ...(latest ?? existing ?? { id: agentId, projectId, updatedAt: now }),
+                    ...latest,
                     id: agentId,
                     projectId,
                     taskId: undefined,
@@ -4642,6 +5392,8 @@ export class AgentManager {
                 };
                 return this.persistQueuedTask(unassigned, 'unassigned');
             }
+            // Capture generation before the first config/group read so a DELETE→same-id recreate in the read→commit window fails the gate.
+            const genAtEntry = this.deletionGenerationOf(input.preferredAgentId);
             const target = await this.pickAgent(projectId, input.preferredAgentId);
             const targetConfig = this.getAgentConfig(input.preferredAgentId);
             const group = this.findAgentGroup(input.preferredAgentId);
@@ -4653,6 +5405,12 @@ export class AgentManager {
             const researchFields = research
                 ? { researchAgentId: research.id, phase: 'research' }
                 : {};
+            // Pin EVERY participant's generation: a member (e.g. QA) deleted→reintroduced after the snapshot leaves isDeletionInFlight false and the preferred generation unchanged, yet the task would still carry its stale id.
+            const participantGens = new Map([dev.id, ...(qa ? [qa.id] : []), ...(research ? [research.id] : [])]
+                .map(id => [id, this.deletionGenerationOf(id)]));
+            const participantsFresh = () => this.deletionGenerationOf(input.preferredAgentId) === genAtEntry
+                && !this.isDeletionInFlight(input.preferredAgentId)
+                && [...participantGens].every(([id, gen]) => this.deletionGenerationOf(id) === gen && !this.isDeletionInFlight(id));
             const queued = {
                 ...taskBase,
                 agentId: '',
@@ -4661,12 +5419,83 @@ export class AgentManager {
                 status: 'pending',
                 ...(qa ? { qaAgentId: qa.id } : {}),
             };
+            // A DELETE→recreate of the preferred OR any participant after the group snapshot must not persist a
+            // pending task carrying its stale devAgentId/qaAgentId; reject and let the client re-select.
+            const persistQueuedOrReject = (reason) => {
+                if (!participantsFresh()) {
+                    throw new ApiError(409, `Agent ${input.preferredAgentId} or a group member is being deleted or recreated during task creation; please retry`);
+                }
+                return this.persistQueuedTask(queued, reason, input.preferredAgentId);
+            };
             if (!target) {
-                return this.persistQueuedTask(queued, 'preferred_agent_busy', input.preferredAgentId);
+                return persistQueuedOrReject('preferred_agent_busy');
+            }
+            if (this.isDeletionInFlight(target.id)) {
+                return persistQueuedOrReject('agent_locked');
             }
             const lockToken = await this.lockManager.acquire(target.id, taskId);
             if (!lockToken) {
-                return this.persistQueuedTask(queued, 'agent_locked', input.preferredAgentId);
+                return persistQueuedOrReject('agent_locked');
+            }
+            // Three-step transaction (queued task → binding → in_progress): any failure leaves at worst a queued task and/or a stale binding to it, both reclaimable — never an active task with no binding.
+            const releaseLock = async () => {
+                try {
+                    await this.lockManager.releaseIfOwner(target.id, taskId, lockToken);
+                }
+                catch (releaseErr) {
+                    console.warn(`[AgentManager] createTask(${taskId}): lock release after failed assignment also failed:`, releaseErr);
+                }
+            };
+            try {
+                await this.taskStore.set(queued);
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            let commit;
+            try {
+                commit = await this.agentStore.update(target.id, (existing) => {
+                    if (existing === null && !this.bindingInitPredicate(target.id, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    if (!this.deletionGateOpen(target.id, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    return {
+                        id: target.id,
+                        projectId,
+                        taskId,
+                        lockToken,
+                        bootstrappingTaskId: taskId,
+                        updatedAt: now,
+                        ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
+                        ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
+                        ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
+                        // A new task never inherits the previous one's question: void the watermark.
+                        needInput: { epoch: (existing?.needInput?.epoch ?? 0) + 1 },
+                    };
+                });
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            if (commit !== 'committed') {
+                await releaseLock();
+                return (await this.taskStore.get(taskId)) ?? queued;
+            }
+            // Binding-before-active: a DELETE slipping in after the binding commit sees a still-'pending' task and can rotate the lock; re-verify lock ownership + preferred/participant generations before the active write, else roll back.
+            if (this.isDeletionInFlight(target.id)
+                || !this.deletionGateOpen(target.id, genAtEntry)
+                || !participantsFresh()
+                || !(await this.lockManager.isOwner(target.id, taskId, lockToken))) {
+                await this.agentStore.update(target.id, (existing) => {
+                    if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                        return AGENT_STORE_NOOP;
+                    const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                    return { ...rest, updatedAt: new Date().toISOString() };
+                });
+                await releaseLock();
+                return (await this.taskStore.get(taskId)) ?? queued;
             }
             const task = {
                 ...taskBase,
@@ -4676,18 +5505,24 @@ export class AgentManager {
                 ...researchFields,
                 status: 'in_progress',
             };
-            await this.taskStore.set(task);
-            await this.agentStore.update(target.id, (existing) => ({
-                id: target.id,
-                projectId,
-                taskId,
-                lockToken,
-                bootstrappingTaskId: taskId,
-                updatedAt: now,
-                ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
-                ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
-                ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
-            }));
+            try {
+                await this.taskStore.set(task);
+            }
+            catch (err) {
+                try {
+                    await this.agentStore.update(target.id, (existing) => {
+                        if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                            return AGENT_STORE_NOOP;
+                        const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                        return { ...rest, updatedAt: new Date().toISOString() };
+                    });
+                }
+                catch (rollbackErr) {
+                    console.warn(`[AgentManager] createTask(${taskId}): binding rollback after task write failure also failed (stale-binding path will reclaim):`, rollbackErr);
+                }
+                await releaseLock();
+                throw err;
+            }
             await this.safeEmit({
                 id: '',
                 type: 'task.assigned',
@@ -4795,6 +5630,9 @@ export class AgentManager {
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new ApiError(404, `Unknown agent: ${agentId}`);
+        // Pin the incarnation before reading paneId: paneId equality is ABA-blind (a recreate reuses %0), so a
+        // DELETE→same-id recreate during the upload would otherwise paste the stale image into the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         const paneId = state?.paneId;
         if (!paneId)
@@ -4804,6 +5642,9 @@ export class AgentManager {
         }
         try {
             const assertUploadStillValid = async () => {
+                if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                    throw new ApiError(409, `Agent ${agentId} was deleted or recreated while uploading; image paste aborted`);
+                }
                 const held = await this.agentStore.get(agentId);
                 if (!held || held.paneId !== paneId) {
                     throw new ApiError(409, `Agent ${agentId} session changed while uploading; image paste aborted`);
@@ -4823,7 +5664,10 @@ export class AgentManager {
             await writeImageToHost(runner, path, bytes);
             await assertUploadStillValid();
             const tmux = new TmuxManager(runner);
-            await tmux.injectPrompt(paneId, `${path} `, agentId);
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
+            // resolveClaimedPane resolved by the CURRENT same-name session; re-verify once more before injecting so a DELETE→recreate in that gap can't take the paste.
+            await assertUploadStillValid();
+            await tmux.injectPrompt(pane, `${path} `, agentId);
             return { path };
         }
         finally {
@@ -4855,9 +5699,10 @@ export class AgentManager {
                 }
             };
             const tmux = new TmuxManager(this.createRunnerFor(cfg));
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
             const waitReady = async () => {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, cfg.runtime, this.manualCompactWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, cfg.runtime, this.manualCompactWaitMs);
                 }
                 catch (err) {
                     const detail = err instanceof Error ? err.message : String(err);
@@ -4866,13 +5711,13 @@ export class AgentManager {
             };
             await waitReady();
             await assertSessionUnchanged();
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             await waitReady();
             await assertSessionUnchanged();
-            await tmux.sendKeysLiteral(paneId, command);
-            await tmux.sendEnter(paneId);
+            await tmux.sendKeysLiteral(pane, command);
+            await tmux.sendEnter(pane);
             guardHandedOff = true;
-            void this.waitForReplPromptReady(tmux, paneId, cfg.runtime, this.compactIdleWaitMs)
+            void this.waitForReplPromptReady(tmux, pane, cfg.runtime, this.compactIdleWaitMs)
                 .catch(err => {
                 console.warn(`[AgentManager] sendSlashCommand(${agentId}, ${command}) post idle wait failed:`, err);
             })
@@ -4891,25 +5736,98 @@ export class AgentManager {
     async clearAgent(agentId) {
         return this.sendSlashCommand(agentId, '/clear');
     }
-    async clearRuntimeForTaskBoundary(tmux, paneId, agentId, runtime, revalidate) {
+    registerPendingDispatchRetry(taskId, entry, budgetOverride) {
+        const prev = this.pendingDispatchRetryByTask.get(taskId);
+        // 预算随登记代走：同 kind 但 pass 换代（token/agent 变化）时必须重置 since 与告警标志。
+        // budgetOverride 供对账内部重排延续同一笔欠投递的预算——它只经 startSession 的 armedToken
+        // fence 注入，外部 successor 的登记结构上拿不到
+        const sameGeneration = prev?.kind === entry.kind
+            && prev.agentId === entry.agentId
+            && prev.signalToken === entry.signalToken;
+        const since = sameGeneration ? prev.since : (budgetOverride?.since ?? Date.now());
+        const budgetAlerted = sameGeneration
+            ? prev.budgetAlerted === true
+            : budgetOverride?.budgetAlerted === true;
+        this.pendingDispatchRetryByTask.set(taskId, {
+            ...entry,
+            since,
+            ...(budgetAlerted ? { budgetAlerted: true } : {}),
+        });
+    }
+    getPendingDispatchRetry(taskId) {
+        return this.pendingDispatchRetryByTask.get(taskId);
+    }
+    listPendingDispatchRetries() {
+        return this.pendingDispatchRetryByTask;
+    }
+    clearPendingDispatchRetry(taskId) {
+        this.pendingDispatchRetryByTask.delete(taskId);
+    }
+    clearPendingDispatchRetryIfMatches(taskId, expected) {
+        const entry = this.pendingDispatchRetryByTask.get(taskId);
+        if (entry?.agentId === expected.agentId && entry.signalToken === expected.signalToken) {
+            this.pendingDispatchRetryByTask.delete(taskId);
+        }
+    }
+    markPendingDispatchRetryBudgetAlerted(taskId, expected) {
+        const entry = this.pendingDispatchRetryByTask.get(taskId);
+        if (entry?.agentId === expected.agentId && entry.signalToken === expected.signalToken) {
+            this.pendingDispatchRetryByTask.set(taskId, { ...entry, budgetAlerted: true });
+        }
+    }
+    async queueQaBusyPendingRetry(taskId, agentId, phase, createdSession, err, dispatch) {
+        if (!(err instanceof ReplNotReadyError))
+            return null;
+        if (phase !== 'review' && phase !== 'recheck')
+            return null;
+        // 无本次派发的 pass 令牌就不登记（宁走既有失败路径，不造无 fence 重试）；
+        // 令牌漂移说明 pass 已被接管，忙碌属于旧派发，不得登记到 successor 上
+        const passToken = dispatch.passToken;
+        if (!passToken)
+            return null;
+        let current;
+        try {
+            current = await this.taskStore.get(taskId);
+        }
+        catch (readErr) {
+            console.warn(`[AgentManager] startSession[${phase}]: busy on task ${taskId} but pass token could not be verified; ` +
+                `falling back to the non-pending failure path:`, readErr);
+            return null;
+        }
+        if (current?.signalToken !== passToken) {
+            console.warn(`[AgentManager] startSession[${phase}]: busy on task ${taskId} but the review pass was superseded ` +
+                `(expected ${passToken}, now ${current?.signalToken ?? 'gone'}); not queueing a pending retry`);
+            return null;
+        }
+        this.registerPendingDispatchRetry(taskId, {
+            kind: 'qa-recheck',
+            agentId,
+            signalToken: passToken,
+            qaPhase: phase,
+        }, dispatch.pendingBudget);
+        console.warn(`[AgentManager] startSession[${phase}]: QA pane busy for task ${taskId}; ` +
+            `${phase} queued for redispatch when idle (${(err.message.split('\n')[0])})`);
+        return new EnsureSessionError({ createdSession, agentId, handled: true, busyPending: true }, `QA REPL busy; ${phase} dispatch for task ${taskId} queued for redispatch when idle`);
+    }
+    async clearRuntimeForTaskBoundary(tmux, pane, agentId, runtime, revalidate) {
         await this.acquireCompactGuard(agentId);
         try {
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.cleanComposerWaitMs);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.cleanComposerWaitMs, { stableIdle: true });
             await revalidate();
-            await tmux.clearComposerDraft(paneId);
-            const baseline = await tmux.captureSettledSnapshot(paneId, {
+            await tmux.clearComposerDraft(pane);
+            const baseline = await tmux.captureSettledSnapshot(pane, {
                 timeoutMs: this.dispatchSettleTimeoutMs,
             });
-            const baselineTitle = await tmux.readPaneTitle(paneId);
-            await tmux.sendKeysLiteral(paneId, '/clear');
-            await tmux.sendEnter(paneId);
-            await tmux.waitSubmitAck(paneId, baseline, runtime, {
+            const baselineTitle = await tmux.readPaneTitle(pane);
+            await tmux.sendKeysLiteral(pane, '/clear');
+            await tmux.sendEnter(pane);
+            await tmux.waitSubmitAck(pane, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
                 acceptComposerChange: true,
             });
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.dispatchAckTimeoutMs);
-            if (await this.hasRuntimeSlashCommandRejection(tmux, paneId, '/clear')) {
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.dispatchAckTimeoutMs, { stableIdle: true });
+            if (await this.hasRuntimeSlashCommandRejection(tmux, pane, '/clear')) {
                 throw new Error('Runtime rejected /clear at the task boundary; refusing to reuse prior task context');
             }
             await revalidate();
@@ -4986,6 +5904,8 @@ export class AgentManager {
                     error: `Task ${taskId} has no preferredAgentId; agentId is required in request body`,
                 };
             }
+            // Capture generation before the first config/state read so a DELETE→same-id recreate in the read→commit window fails the gate.
+            const genAtEntry = this.deletionGenerationOf(agentId);
             const cfg = this.getAgentConfig(agentId);
             if (!cfg)
                 return { task: fresh, errorCode: 400, error: `Unknown agent: ${agentId}` };
@@ -5006,6 +5926,9 @@ export class AgentManager {
             if (!canDispatchWithBinding(state)) {
                 return { task: fresh, errorCode: 409, error: `Agent ${agentId} is busy or awaiting human` };
             }
+            if (this.isDeletionInFlight(agentId)) {
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
             const lockToken = await this.lockManager.acquire(agentId, taskId);
             if (!lockToken) {
                 return { task: fresh, errorCode: 409, error: `Agent ${agentId} lock acquisition failed` };
@@ -5024,6 +5947,10 @@ export class AgentManager {
                 ? group?.find(agent => agent.role === 'qa')?.id
                 : fresh.qaAgentId;
             const researchId = initiallyUnassigned && cfg.role === 'research' ? cfg.id : fresh.researchAgentId;
+            // Pin every participant's generation (mirror createTask) so a member deleted→recreated before the active write isn't baked in.
+            const participantGens = new Map([devId, ...(qaId ? [qaId] : []), ...(researchId ? [researchId] : [])]
+                .map(pid => [pid, this.deletionGenerationOf(pid)]));
+            const participantsFresh = () => [...participantGens].every(([pid, gen]) => this.deletionGenerationOf(pid) === gen && !this.isDeletionInFlight(pid));
             const claimedTask = {
                 ...fresh,
                 preferredAgentId: agentId,
@@ -5035,18 +5962,78 @@ export class AgentManager {
                 status: 'in_progress',
                 updatedAt: now,
             };
-            await this.taskStore.set(claimedTask);
-            await this.agentStore.update(agentId, (existing) => ({
-                id: agentId,
-                projectId: cfg.projectId,
-                taskId,
-                lockToken,
-                bootstrappingTaskId: taskId,
-                updatedAt: now,
-                ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
-                ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
-                ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
-            }));
+            // Binding-first: the fresh task snapshot already exists on disk, so a failure at any later
+            // step leaves at worst a stale binding to a still-unclaimed task — an existing reclaimable state.
+            const releaseLock = async () => {
+                try {
+                    await this.lockManager.releaseIfOwner(agentId, taskId, lockToken);
+                }
+                catch (releaseErr) {
+                    console.warn(`[AgentManager] claimTask(${taskId}): lock release after failed claim also failed:`, releaseErr);
+                }
+            };
+            let commit;
+            try {
+                commit = await this.agentStore.update(agentId, (existing) => {
+                    if (existing === null && !this.bindingInitPredicate(agentId, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    if (!this.deletionGateOpen(agentId, genAtEntry))
+                        return AGENT_STORE_NOOP;
+                    return {
+                        id: agentId,
+                        projectId: cfg.projectId,
+                        taskId,
+                        lockToken,
+                        bootstrappingTaskId: taskId,
+                        updatedAt: now,
+                        ...(existing?.paneId !== undefined ? { paneId: existing.paneId } : {}),
+                        ...(existing?.workdir !== undefined ? { workdir: existing.workdir } : {}),
+                        ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
+                        // A new task never inherits the previous one's question: void the watermark.
+                        needInput: { epoch: (existing?.needInput?.epoch ?? 0) + 1 },
+                    };
+                });
+            }
+            catch (err) {
+                await releaseLock();
+                throw err;
+            }
+            if (commit !== 'committed') {
+                await releaseLock();
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
+            // Re-verify lock ownership + preferred/participant generations before the active write, else a DELETE after the binding commit orphans it.
+            if (this.isDeletionInFlight(agentId)
+                || !this.deletionGateOpen(agentId, genAtEntry)
+                || !participantsFresh()
+                || !(await this.lockManager.isOwner(agentId, taskId, lockToken))) {
+                await this.agentStore.update(agentId, (existing) => {
+                    if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                        return AGENT_STORE_NOOP;
+                    const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                    return { ...rest, updatedAt: new Date().toISOString() };
+                });
+                await releaseLock();
+                return { task: fresh, errorCode: 409, error: `Agent ${agentId} is being deleted` };
+            }
+            try {
+                await this.taskStore.set(claimedTask);
+            }
+            catch (err) {
+                try {
+                    await this.agentStore.update(agentId, (existing) => {
+                        if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken)
+                            return AGENT_STORE_NOOP;
+                        const { taskId: _t, lockToken: _l, bootstrappingTaskId: _b, ...rest } = existing;
+                        return { ...rest, updatedAt: new Date().toISOString() };
+                    });
+                }
+                catch (rollbackErr) {
+                    console.warn(`[AgentManager] claimTask(${taskId}): binding rollback after task write failure also failed (stale-binding path will reclaim):`, rollbackErr);
+                }
+                await releaseLock();
+                throw err;
+            }
             await this.safeEmit({
                 id: '',
                 type: 'task.assigned',
@@ -5146,6 +6133,8 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             throw new Error(`Unknown agent: ${agentId}`);
+        // Pin the incarnation: a DELETE completing during dispatch bumps this, and every gated commit/side-effect below refuses the stale generation.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const task = await this.taskStore.get(taskId);
         if (!task)
             throw new Error(`Unknown task: ${taskId}`);
@@ -5191,6 +6180,11 @@ export class AgentManager {
             return false;
         }
         const assertOwner = async () => {
+            // Also gate on the entry generation: a DELETE→same-id recreate can pass the task/lock check on the
+            // reused binding, so every Workdir/runtime side-effect guarded by assertOwner must fail closed on it.
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new Error(`Agent ${agentId} is being deleted or was recreated for task ${taskId}; operation aborted`);
+            }
             const stateNow = await this.agentStore.get(agentId);
             if (stateNow?.taskId !== taskId || stateNow.lockToken !== lockToken) {
                 throw new Error(`Agent ${agentId} binding changed for task ${taskId}; operation aborted`);
@@ -5201,10 +6195,10 @@ export class AgentManager {
         const dialogFailFromStatuses = opts.dialogFailFromStatuses ?? PHASE_EXPECTED_STATUS[phase] ?? [...ACTIVE_TASK_STATUSES];
         let ensure;
         try {
-            ensure = await this.ensureSession(agentId, 'runtime');
+            ensure = await this.ensureSession(agentId, 'runtime', { expectedGeneration: genAtEntry });
         }
         catch (err) {
-            if (await this.handleDialogPendingFromRuntime(agentId, err, { expectedFromStatuses: dialogFailFromStatuses })) {
+            if (await this.handleDialogPendingFromRuntime(agentId, err, { expectedFromStatuses: dialogFailFromStatuses, expectedGeneration: genAtEntry })) {
                 throw err;
             }
             if (err instanceof EnsureSessionError && err.partial.createdSession) {
@@ -5222,7 +6216,7 @@ export class AgentManager {
             }
             throw err;
         }
-        const { paneId, workdir } = ensure;
+        const { paneId, pane, workdir } = ensure;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const branchManager = new BranchManager(runner);
@@ -5230,7 +6224,15 @@ export class AgentManager {
         if (!lockState || lockState.taskId !== taskId || lockState.lockToken !== lockToken)
             return false;
         await assertOwner();
-        await this.waitForReplPromptReady(tmux, paneId, agent.runtime, this.cleanComposerWaitMs);
+        try {
+            await this.waitForReplPromptReady(tmux, pane, agent.runtime, this.cleanComposerWaitMs, { stableIdle: true });
+        }
+        catch (err) {
+            const busyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (busyPend)
+                throw busyPend;
+            throw err;
+        }
         const isServerQaPhase = phase === 'server-review' || phase === 'server-recheck' || phase === 'server-spec-review';
         const isServerCodeReviewPhase = phase === 'server-review' || phase === 'server-recheck';
         let reviewCheckout;
@@ -5266,12 +6268,15 @@ export class AgentManager {
             }
             await assertOwner();
             if (!ensure.freshRuntime) {
-                await this.clearRuntimeForTaskBoundary(tmux, paneId, agentId, agent.runtime, assertOwner);
+                await this.clearRuntimeForTaskBoundary(tmux, pane, agentId, agent.runtime, assertOwner);
                 if (ensure.skillsStale)
                     await this.tagSessionSkillsVersion(tmux, agentId, ensure.sessionRef);
             }
         }
         catch (err) {
+            const busyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (busyPend)
+                throw busyPend;
             const message = err instanceof Error ? err.message : String(err);
             const holdPhase = err instanceof DirtyWorkdirError
                 ? 'dirty-workdir'
@@ -5311,9 +6316,9 @@ export class AgentManager {
         await this.agentStore.update(agentId, (stateNow) => {
             if (!stateNow || stateNow.taskId !== taskId)
                 return AGENT_STORE_NOOP;
-            const { needInputAt: _needInputAt, ...rest } = stateNow;
+            // Watermark stays: the arm-time epoch bump owns superseding the old question.
             return {
-                ...rest,
+                ...stateNow,
                 paneId,
                 workdir,
                 updatedAt: new Date().toISOString(),
@@ -5346,13 +6351,16 @@ export class AgentManager {
                     ...(opts.serverPriorResponse ? { serverPriorResponse: opts.serverPriorResponse } : {}),
                 });
             }
+            const taskForPrompt = await this.ensureGitBaseSnapshot(task, phase);
+            const platformCli = this.platformCliContextOf(taskForPrompt);
             prompt = buildPromptInline({
-                task,
+                task: taskForPrompt,
                 phase,
                 agent,
                 workdir: dispatchWorkdir,
                 skillRegistry: this.skillRegistry,
                 hasQaPartner,
+                ...(platformCli ? { platformCli } : {}),
                 ...(promptSignalToken ? { signalToken: promptSignalToken } : {}),
                 ...(promptSpecRound !== undefined ? { currentSpecRound: promptSpecRound } : {}),
                 ...(imagePaths.length ? { imagePaths } : {}),
@@ -5416,12 +6424,20 @@ export class AgentManager {
         let agentMarkedRunning = false;
         try {
             let cancelHoldWon = false;
-            await this.agentStore.update(agentId, (existing) => {
+            let deletedDuringDispatch = false;
+            const runningCommit = await this.agentStore.update(agentId, (existing) => {
                 if (isCancelCleanupHold(existing)) {
                     cancelHoldWon = true;
                     return AGENT_STORE_NOOP;
                 }
+                // Binding must already exist and still hold our lock; never re-create a deleted agent's state nor write under a bumped deletion generation (ABA).
+                if (!existing || existing.taskId !== taskId || existing.lockToken !== lockToken
+                    || !this.deletionGateOpen(agentId, genAtEntry)) {
+                    deletedDuringDispatch = true;
+                    return AGENT_STORE_NOOP;
+                }
                 return {
+                    ...existing,
                     id: agentId,
                     projectId: agent.projectId,
                     paneId,
@@ -5431,7 +6447,6 @@ export class AgentManager {
                     startedAt: now,
                     bootstrappingTaskId: taskId,
                     updatedAt: now,
-                    ...(existing?.creationToken !== undefined ? { creationToken: existing.creationToken } : {}),
                 };
             });
             if (cancelHoldWon) {
@@ -5440,8 +6455,39 @@ export class AgentManager {
                 await cleanupCheckoutOrHold();
                 return false;
             }
+            if (deletedDuringDispatch || runningCommit !== 'committed') {
+                console.warn(`[AgentManager] startSession[${phase}]: agent ${agentId} binding vanished or was deleted/recreated ` +
+                    `during dispatch; not marking running (no orphan state)`);
+                return false;
+            }
             agentMarkedRunning = true;
-            await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime);
+            // armed pass 的 fence 延伸到最终 paste：checkout//clear/artifacts 的 await 窗口里 pass 可被
+            // push/其他 dispatcher 轮换，旧 prompt 不得注入 successor；guard 在 composer/paste/Enter
+            // 的 task-mutation 队列槽内复核（与轮换串行），漂移即放弃投递。
+            // cancel 只写终态不轮换 token，故 fence 须同时复核任务仍处本相位的可投递状态
+            const passDeliverableStatuses = opts.dialogFailFromStatuses ?? PHASE_EXPECTED_STATUS[phase] ?? [...ACTIVE_TASK_STATUSES];
+            const passStillArmed = opts.dispatchPassToken !== undefined
+                ? async () => {
+                    const freshTask = await this.taskStore.get(taskId);
+                    if (!freshTask || freshTask.signalToken !== opts.dispatchPassToken)
+                        return false;
+                    return passDeliverableStatuses.includes(freshTask.status);
+                }
+                : undefined;
+            if (passStillArmed && !(await passStillArmed())) {
+                console.warn(`[AgentManager] startSession[${phase}]: review pass superseded before injection for task ${taskId}; aborting paste`);
+                return false;
+            }
+            const injectResult = await this.injectAndAwaitAck(tmux, pane, prompt, agentId, agent.runtime, passStillArmed);
+            if (injectResult.aborted === true) {
+                console.warn(`[AgentManager] startSession[${phase}]: injection fenced off (pass superseded) for task ${taskId}`);
+                return false;
+            }
+            // prompt 已确认投递：只 CAS 清理本次派发那一代的登记；successor 在窗口内登记的新 pending 不受影响，
+            // 且清理先于可失败的审计事件——事件写失败不能把已投递的 prompt 重新变回 pending
+            if (opts.dispatchPassToken !== undefined) {
+                this.clearPendingDispatchRetryIfMatches(taskId, { agentId, signalToken: opts.dispatchPassToken });
+            }
             try {
                 await this.clearBootstrapMarker(agentId, taskId);
             }
@@ -5465,6 +6511,11 @@ export class AgentManager {
             return true;
         }
         catch (err) {
+            // 注入阶段的忙碌（预注入活回合检查）仍在任何按键之前：登记 pending 并保持 checkout/绑定原样，
+            // 在途回合还在使用该工作树，park/release 会拽走它
+            const injectBusyPend = await this.queueQaBusyPendingRetry(taskId, agentId, phase, ensure.createdSession, err, { passToken: opts.dispatchPassToken, pendingBudget: opts.dispatchPendingBudget });
+            if (injectBusyPend)
+                throw injectBusyPend;
             const isAckUnknown = err instanceof DispatchTerminalError && err.reason === 'ack_unknown';
             if (!isAckUnknown) {
                 await cleanupCheckoutOrHold();
@@ -5507,7 +6558,7 @@ export class AgentManager {
             throw err;
         }
     }
-    async injectAndAwaitAck(tmux, paneId, prompt, agentId, runtime, guardBeforePaste) {
+    async injectAndAwaitAck(tmux, pane, prompt, agentId, runtime, guardBeforePaste) {
         const before = await this.agentStore.get(agentId);
         const beforeLockToken = before?.taskId
             ? await this.resolveTaskLockToken(before, before.taskId)
@@ -5559,21 +6610,22 @@ export class AgentManager {
             if (guardBeforePaste && !(await guardBeforePaste())) {
                 return { acked: false, composerDelivered: false, aborted: true };
             }
-            return await this.injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste);
+            return await this.injectAndAwaitAckSteps(tmux, pane, prompt, agentId, runtime, revalidate, guardBeforePaste);
         }
         finally {
             this.compactInFlight.delete(agentId);
         }
     }
-    async injectAndAwaitAckSteps(tmux, paneId, prompt, agentId, runtime, revalidate, guardBeforePaste) {
+    async injectAndAwaitAckSteps(tmux, pane, prompt, agentId, runtime, revalidate, guardBeforePaste) {
+        const paneId = pane.paneId;
         // 静态忙信号（文本忙样式/working title）可能是残稿或 stale title 冒充，一律由帧活性仲裁；ready 视图覆盖 stale title。
-        const preTitle = await tmux.readPaneTitle(paneId);
-        const preFrame = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+        const preTitle = await tmux.readPaneTitle(pane);
+        const preFrame = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
         const staticBusy = hasOscTitleWorking(preTitle)
             ? (runtimeBusyCheck(preFrame, runtime) || !hasRuntimeReadyView(preFrame, runtime))
             : runtimeBusyCheck(preFrame, runtime);
-        if (staticBusy && await this.paneHasLiveTurn(tmux, paneId, runtime)) {
-            throw new Error(`pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
+        if (staticBusy && await this.paneHasLiveTurn(tmux, pane, runtime)) {
+            throw new ReplNotReadyError(paneId, runtime, preFrame, `pre-inject busy check: pane ${paneId} is still running a turn; dispatch aborted`);
         }
         await revalidate?.();
         if (guardBeforePaste) {
@@ -5588,7 +6640,7 @@ export class AgentManager {
                 pasted = await this.withTaskLock(async () => {
                     if (!(await guardBeforePaste()))
                         return false;
-                    await tmux.clearComposerDraft(paneId);
+                    await tmux.clearComposerDraft(pane);
                     await tmux.pasteStagedBuffer(paneId, staged.buf);
                     return true;
                 });
@@ -5605,7 +6657,7 @@ export class AgentManager {
                 }
                 if (bufferConsumed) {
                     try {
-                        await tmux.clearComposerDraft(paneId);
+                        await tmux.clearComposerDraft(pane);
                     }
                     catch (clearErr) {
                         console.warn(`[AgentManager] composer scrub after unknown paste outcome failed for pane ${paneId}:`, clearErr);
@@ -5624,26 +6676,26 @@ export class AgentManager {
             }
         }
         else {
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             await revalidate?.();
-            await tmux.injectPrompt(paneId, prompt, agentId);
+            await tmux.injectPrompt(pane, prompt, agentId);
         }
         let baseline;
         let baselineTitle = '';
         try {
-            baseline = await tmux.captureSettledSnapshot(paneId, { timeoutMs: this.dispatchSettleTimeoutMs });
-            baselineTitle = await tmux.readPaneTitle(paneId);
+            baseline = await tmux.captureSettledSnapshot(pane, { timeoutMs: this.dispatchSettleTimeoutMs });
+            baselineTitle = await tmux.readPaneTitle(pane);
             if (guardBeforePaste) {
                 // The Enter is the actual submission; it takes the same fenced queue slot.
                 const submitted = await this.withTaskLock(async () => {
                     if (!(await guardBeforePaste()))
                         return false;
-                    await tmux.sendEnter(paneId);
+                    await tmux.sendEnter(pane);
                     return true;
                 });
                 if (!submitted) {
                     try {
-                        await tmux.clearComposerDraft(paneId);
+                        await tmux.clearComposerDraft(pane);
                     }
                     catch (err) {
                         // Fail closed: a submit-ready stale prompt could not be confirmed gone.
@@ -5654,18 +6706,18 @@ export class AgentManager {
                 }
             }
             else {
-                await tmux.sendEnter(paneId);
+                await tmux.sendEnter(pane);
             }
         }
         catch (preAckErr) {
-            if (await this.clearComposerForReuse(tmux, paneId, agentId))
+            if (await this.clearComposerForReuse(tmux, pane, agentId))
                 throw preAckErr;
             const message = preAckErr instanceof Error ? preAckErr.message : String(preAckErr);
             throw new DispatchTerminalError('ack_unknown', `pre-ack failure left an unconfirmed composer on live pane ${paneId}: ${message}`);
         }
         let staleDuringResend = false;
         try {
-            await tmux.waitSubmitAck(paneId, baseline, runtime, {
+            await tmux.waitSubmitAck(pane, baseline, runtime, {
                 timeoutMs: this.dispatchAckTimeoutMs,
                 baselineTitle,
                 resend: guardBeforePaste
@@ -5674,13 +6726,13 @@ export class AgentManager {
                         const resent = await this.withTaskLock(async () => {
                             if (!(await guardBeforePaste()))
                                 return false;
-                            await tmux.sendEnter(paneId);
+                            await tmux.sendEnter(pane);
                             return true;
                         });
                         if (!resent)
                             staleDuringResend = true;
                     }
-                    : () => tmux.sendEnter(paneId),
+                    : () => tmux.sendEnter(pane),
                 resendIntervalMs: this.dispatchAckResendIntervalMs,
             });
             return { acked: true, composerDelivered: true };
@@ -5692,7 +6744,7 @@ export class AgentManager {
             }
             if (staleDuringResend) {
                 try {
-                    await tmux.clearComposerDraft(paneId);
+                    await tmux.clearComposerDraft(pane);
                 }
                 catch (scrubErr) {
                     const scrubMessage = scrubErr instanceof Error ? scrubErr.message : String(scrubErr);
@@ -5714,9 +6766,10 @@ export class AgentManager {
             return { acked: false, composerDelivered };
         }
     }
-    async clearComposerForReuse(tmux, paneId, agentId) {
+    async clearComposerForReuse(tmux, pane, agentId) {
+        const paneId = pane.paneId;
         try {
-            await tmux.clearComposerDraft(paneId);
+            await tmux.clearComposerDraft(pane);
             return true;
         }
         catch (err) {
@@ -5793,7 +6846,7 @@ export class AgentManager {
             }
             throw err;
         }
-        const { paneId } = ensure;
+        const { paneId, pane } = ensure;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const stateAfterEnsure = await this.agentStore.get(agentId);
@@ -5877,13 +6930,16 @@ export class AgentManager {
                     ...(opts.serverPriorResponse ? { serverPriorResponse: opts.serverPriorResponse } : {}),
                 });
             }
+            const taskForPrompt = await this.ensureGitBaseSnapshot(task, phase);
+            const platformCli = this.platformCliContextOf(taskForPrompt);
             prompt = buildPromptInline({
-                task,
+                task: taskForPrompt,
                 phase,
                 agent,
                 workdir: verifiedWorkdir,
                 skillRegistry: this.skillRegistry,
                 hasQaPartner: task.qaAgentId !== undefined,
+                ...(platformCli ? { platformCli } : {}),
                 ...(signalToken ? { signalToken } : {}),
                 ...(useIncrementalNudge
                     ? { postApproveRedispatchCount: opts.postApproveRedispatchCount }
@@ -5969,10 +7025,11 @@ export class AgentManager {
                 || latest.workdir !== verifiedWorkdir) {
                 return AGENT_STORE_NOOP;
             }
-            // The continuation prompt supersedes any question asked under the previous one.
-            const { needInputAt: _needInputAt, ...rest } = latest;
+            // The continuation prompt supersedes the previous question, but the arm-time
+            // epoch bump owns that transition — stripping here would race an arm that
+            // already re-established the watermark (post-approve arms before injecting).
             return {
-                ...rest,
+                ...latest,
                 paneId,
                 workdir: verifiedWorkdir,
                 lockToken,
@@ -5996,7 +7053,7 @@ export class AgentManager {
             console.warn(`[AgentManager] continueSession[${phase}]: pre-inject guard rejected the paste for task ${taskId}; skipping`);
             return false;
         }
-        const delivery = await this.injectAndAwaitAck(tmux, paneId, prompt, agentId, agent.runtime, guardBeforeInject);
+        const delivery = await this.injectAndAwaitAck(tmux, pane, prompt, agentId, agent.runtime, guardBeforeInject);
         if (delivery.aborted) {
             console.warn(`[AgentManager] continueSession[${phase}]: pre-paste guard rejected the inject for task ${taskId}; skipping`);
             return false;
@@ -6188,7 +7245,7 @@ export class AgentManager {
                     continue;
                 if (state.creationToken && !state.taskId) {
                     const ct = state.creationToken;
-                    const pane = result.paneId;
+                    const pane = result.pane;
                     const cfg = agentConfig;
                     const agentId = state.id;
                     void (async () => {
@@ -6197,7 +7254,7 @@ export class AgentManager {
                                 if (!latest || latest.creationToken !== ct)
                                     return AGENT_STORE_NOOP;
                                 const { creationToken: _ct, status: _s, awaitingPhase: _ap, awaitingReason: _ar, awaitingSince: _as, ...ready } = latest;
-                                return { ...ready, paneId: pane, updatedAt: new Date().toISOString() };
+                                return { ...ready, paneId: pane.paneId, updatedAt: new Date().toISOString() };
                             });
                         }
                         else {
@@ -6275,6 +7332,7 @@ export class AgentManager {
                         ...(latest.taskId !== undefined ? { taskId: latest.taskId } : {}),
                         ...(latest.lockToken !== undefined ? { lockToken: latest.lockToken } : {}),
                         ...(latest.startedAt !== undefined ? { startedAt: latest.startedAt } : {}),
+                        ...(latest.needInput !== undefined ? { needInput: latest.needInput } : {}),
                     };
                     if (!preserveHeld)
                         return withBinding;
@@ -6615,19 +7673,22 @@ export class AgentManager {
     async dispatchReviewToQa(taskId, opts = {}) {
         const claim = await this.withTaskLock(async () => {
             if (this.manualReviewInFlight.has(taskId)) {
-                throw new ApiError(409, `Manual review already in progress for task ${taskId}`);
+                throw new ApiError(409, `Manual review already in progress for task ${taskId}`, 'dispatch-in-flight');
             }
             if (this.markCompleteInFlight.has(taskId)) {
-                throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`);
+                throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`, 'dispatch-in-flight');
             }
             const task = await this.taskStore.get(taskId);
             if (!task)
                 throw new ApiError(404, `Task ${taskId} not found`);
             if (opts.fromStatus && !opts.fromStatus.includes(task.status)) {
-                throw new ApiError(409, `Task ${taskId} status is ${task.status}; review dispatch requires ${opts.fromStatus.join('/')}`);
+                throw new ApiError(409, `Task ${taskId} status is ${task.status}; review dispatch requires ${opts.fromStatus.join('/')}`, 'dispatch-superseded');
             }
             if (opts.expectSignalToken !== undefined && task.signalToken !== opts.expectSignalToken) {
-                throw new ApiError(409, `Task ${taskId} review pass changed during redispatch (signalToken rotated); aborting`);
+                throw new ApiError(409, `Task ${taskId} review pass changed during redispatch (signalToken rotated); aborting`, 'dispatch-superseded');
+            }
+            if (opts.expectReviewDispatchPending === true && task.reviewDispatchPending !== true) {
+                throw new ApiError(409, `Task ${taskId} review dispatch pending was already consumed; aborting stale sweep`, 'dispatch-superseded');
             }
             if (task.reviewMode === 'server' || isSpecStagePhase(task.phase)) {
                 if (!MANUAL_SERVER_REVIEW_STATUSES.includes(task.status)) {
@@ -6668,17 +7729,33 @@ export class AgentManager {
                 throw new ApiError(409, `Task ${taskId} QA participant ${qaId} is unavailable`);
             }
             this.manualReviewInFlight.add(taskId);
-            return { mode: 'github', qaId, devAgentId: task.agentId, taskStatusAtClaim: task.status };
+            return {
+                mode: 'github',
+                qaId,
+                devAgentId: task.agentId,
+                taskStatusAtClaim: task.status,
+                signalTokenAtClaim: task.signalToken,
+                reviewRoundAtClaim: task.reviewRound,
+            };
         });
         if (claim.mode === 'server') {
             return this.runManualServerReview(taskId, claim);
         }
         try {
-            const { qaId, devAgentId, taskStatusAtClaim } = claim;
+            const { qaId, devAgentId, taskStatusAtClaim, signalTokenAtClaim, reviewRoundAtClaim } = claim;
             const isTerminal = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            const qaPhase = taskStatusAtClaim === 'pending' || taskStatusAtClaim === 'in_progress'
-                ? 'review'
-                : 'recheck';
+            // 相位恢复归标准入口自己（手工 review API 与各补派方一视同仁）：同代 pending 登记的
+            // 原始相位最权威；重启丢登记时以持久化 round=0 兜底——轮次送达才入账，故 0 即首评从未送达
+            const pendingEntry = this.getPendingDispatchRetry(taskId);
+            const queuedPhase = pendingEntry?.kind === 'qa-recheck'
+                && pendingEntry.signalToken === signalTokenAtClaim
+                ? pendingEntry.qaPhase
+                : undefined;
+            const qaPhase = opts.qaPhase
+                ?? queuedPhase
+                ?? (taskStatusAtClaim === 'pending' || taskStatusAtClaim === 'in_progress' || reviewRoundAtClaim === 0
+                    ? 'review'
+                    : 'recheck');
             const prevQa = await this.agentStore.get(qaId);
             const resumingHeldDispatch = prevQa?.taskId === taskId && prevQa.status === 'awaiting_human';
             if (prevQa?.taskId === taskId) {
@@ -6703,12 +7780,13 @@ export class AgentManager {
                     throw new ApiError(409, `QA agent ${qaId} could not be released from task ${taskId}${holdNote}; review dispatch aborted`);
                 }
             }
-            const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase);
+            let acquiredLockToken;
+            const acquired = await this.acquireAgentForTask(qaId, taskId, qaPhase, {
+                onAcquired: (lockToken) => { acquiredLockToken = lockToken; },
+            });
             if (!acquired) {
                 throw new ApiError(409, `QA agent ${qaId} is busy or unavailable`);
             }
-            const acquiredClaim = await this.lockManager.claimOf(qaId);
-            const acquiredLockToken = acquiredClaim?.taskId === taskId ? acquiredClaim.token : undefined;
             const releaseOwnAcquire = acquiredLockToken !== undefined
                 ? { expectedLockToken: acquiredLockToken }
                 : {};
@@ -6735,18 +7813,21 @@ export class AgentManager {
                 signalToken: pre?.signalToken,
                 reviewHeadAnchorSha: pre?.reviewHeadAnchorSha,
                 reviewDispatchedAt: pre?.reviewDispatchedAt,
+                reviewRoundPending: pre?.reviewRoundPending,
                 passToken: pre?.passToken,
                 failToken: pre?.failToken,
             };
             const isTerminalAtClaim = TERMINAL_STATUSES.includes(taskStatusAtClaim);
-            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮
-            const bumpRound = opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review');
+            // 仅当恢复的是任务当前 review pass 时沿用轮次；任务已离开 review 的手工调用是新 pass，保留加轮。
+            // 显式 bumpRound:true 是补派方读到 reviewRoundPending 后的权威意图（该轮从未计数），越过恢复期抑制
+            const bumpRound = opts.bumpRound === true
+                || (opts.bumpRound !== false && !(resumingHeldDispatch && taskStatusAtClaim === 'review'));
             // 回滚在锁内判定 pass 是否已被并发接管并返回；仅未被接管时才释放本次 acquire 的 QA，
             // 否则会误清接管方 re-acquire 的同一 QA 绑定（同 task 同 agent，绕过 release 的 mismatch 保护）
             const abortDispatch = async (dispatchToken) => {
-                const takenOver = await this.rollbackDispatchReviewPhase1(taskId, taskStatusAtClaim, isTerminalAtClaim, snapshot, bumpRound, dispatchToken);
+                const takenOver = await this.rollbackDispatchReviewPhase1(taskId, taskStatusAtClaim, isTerminalAtClaim, snapshot, dispatchToken);
                 if (!takenOver)
-                    await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => undefined);
+                    await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                 if (devParked)
                     await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
             };
@@ -6775,7 +7856,7 @@ export class AgentManager {
                 if (isGitDispatch && reviewAnchor === undefined) {
                     // 无锚评审轮不可裁决（verdictEligible 要求 anchorSha 且 pane verdict 已退役）：
                     // 派出去只会卡死在 review，fail loud 让调用方看到确定性原因或重试瞬态失败
-                    const released = await this.releaseAgentForTask(qaId, taskId, 'idle').catch(() => false);
+                    const released = await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => false);
                     if (!released) {
                         // 预检失败叠加释放失败：QA 仍绑定会让下一次派发报 busy，必须显式暴露
                         const blockedTask = await this.taskStore.get(taskId);
@@ -6798,6 +7879,9 @@ export class AgentManager {
                     reviewHeadAnchorSha: reviewAnchor,
                     reviewDispatchedAt: new Date().toISOString(),
                     signalToken: createSignalToken(),
+                    // 未计轮 intent 与进入 review 同一原子写：两写之间崩溃会留下「有派发可重放、却无轮次可补计」
+                    // 的状态，恢复后首评仍停在旧轮
+                    ...(bumpRound ? { reviewRoundPending: true } : {}),
                     // pair/pending 与新轮锚点同一原子写可见（spec §7）：两写之间崩溃不得留下无 pending 的新轮
                     ...(isGitDispatch ? { ...this.mintReviewTokenPair(), reviewDispatchPending: true } : {}),
                 });
@@ -6806,7 +7890,7 @@ export class AgentManager {
                     await this.releaseAgentForTask(qaId, taskId, 'idle', releaseOwnAcquire).catch(() => undefined);
                     if (devParked)
                         await this.emitManualReviewDevParkedQaFailedIntervention(devAgentId, taskId);
-                    throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`);
+                    throw new ApiError(409, `Task ${taskId} status changed during dispatch; cannot enter review`, 'dispatch-superseded');
                 }
                 transitionToken = preDispatched.task.signalToken;
             }
@@ -6827,7 +7911,9 @@ export class AgentManager {
                 }
                 await this.taskStore.set({
                     ...fresh,
-                    reviewRound: bumpRound ? fresh.reviewRound + 1 : fresh.reviewRound,
+                    // 计轮送达时才落账：claim 段只持久化「未计轮」intent（与 push 直派链路同构），
+                    // busy/hold/崩溃等一切未送达出口都保留 intent，任何补派方（含重启后）恰好补计一次
+                    ...(bumpRound ? { reviewRoundPending: true } : {}),
                     signalToken: armedToken,
                     ...(fresh.reviewMode === 'git' ? { reviewDispatchPending: true } : {}),
                     updatedAt: new Date().toISOString(),
@@ -6837,10 +7923,14 @@ export class AgentManager {
             if (!claim2.ok) {
                 // 未写入 armedToken：task 仍持 transitionToken，或已被接管方 rotate/漂移 → 用 transitionToken 判 takeover
                 await abortDispatch(transitionToken);
-                throw new ApiError(409, `Task ${taskId} left its review pass during dispatch (${claim2.reason})`);
+                throw new ApiError(409, `Task ${taskId} left its review pass during dispatch (${claim2.reason})`, 'dispatch-superseded');
             }
+            opts.onPassArmed?.(armedToken);
             const dispatchTaskAfterClaim = await this.taskStore.get(taskId);
-            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken, dispatchTaskAfterClaim?.reviewMode === 'git' ? { replaceScope: 'agent' } : {});
+            const armed = await this.setupPhaseSignalWatcher(taskId, qaId, ['pr-approved', 'pr-changes-requested'], armedToken, {
+                needInputMode: 'fresh',
+                ...(dispatchTaskAfterClaim?.reviewMode === 'git' ? { replaceScope: 'agent' } : {}),
+            });
             if (armed && dispatchTaskAfterClaim?.reviewMode === 'git') {
                 await this.rearmGitReconciliationWatcher(taskId);
             }
@@ -6853,7 +7943,7 @@ export class AgentManager {
                 const preStart = await this.taskStore.get(taskId);
                 if (!preStart || !opts.fromStatus.includes(preStart.status) || preStart.signalToken !== armedToken) {
                     await abortDispatch(armedToken);
-                    throw new ApiError(409, `Task ${taskId} left ${opts.fromStatus.join('/')} during dispatch (now ${preStart?.status ?? 'gone'})`);
+                    throw new ApiError(409, `Task ${taskId} left ${opts.fromStatus.join('/')} during dispatch (now ${preStart?.status ?? 'gone'})`, 'dispatch-superseded');
                 }
             }
             let started = false;
@@ -6861,6 +7951,8 @@ export class AgentManager {
                 started = await this.startSession(taskId, qaId, qaPhase, {
                     bypassTaskStatusGate: true,
                     dialogFailFromStatuses: [isTerminalAtClaim ? taskStatusAtClaim : 'review'],
+                    dispatchPassToken: armedToken,
+                    ...(opts.pendingBudget !== undefined ? { dispatchPendingBudget: opts.pendingBudget } : {}),
                 });
             }
             catch (err) {
@@ -6874,6 +7966,13 @@ export class AgentManager {
                     }
                     throw err;
                 }
+                if (err instanceof EnsureSessionError && err.partial.busyPending) {
+                    // 遇忙不算失败：pass 保持 armed、QA 保持绑定、未计轮 intent 原样在库（送达时才消费），
+                    // 由对账按 pending 登记补派
+                    console.warn(`[AgentManager] dispatchReviewToQa: QA busy for ${taskId}; dispatch queued (${err.message})`);
+                    const pending = await this.taskStore.get(taskId);
+                    return pending;
+                }
                 if (!(err instanceof EnsureSessionError && err.partial.handled)) {
                     await abortDispatch(armedToken);
                 }
@@ -6883,6 +7982,7 @@ export class AgentManager {
                 await abortDispatch(armedToken);
                 throw new ApiError(500, `Failed to start QA review session for ${taskId}`);
             }
+            await this.consumeReviewRoundIntent(taskId, armedToken);
             await this.clearReviewDispatchPending(taskId, armedToken);
             const final = await this.taskStore.get(taskId);
             return final;
@@ -7023,7 +8123,7 @@ export class AgentManager {
     // 返回 qaTakenOverInReview：仍在 review 但 token 已换代 = 另一 dispatcher 已 release+acquire 同一 QA
     // （同 task 同 agent，releaseAgentForTask 的 mismatch 保护不设防），此时调用方不得再 release QA。
     // 判定在回滚同一锁段内基于 fresh 完成，是那一刻的权威结论——不受本函数随后恢复 snapshot token 的影响。
-    async rollbackDispatchReviewPhase1(taskId, originalStatus, isTerminalAtClaim, snapshot, roundBumped, dispatchToken) {
+    async rollbackDispatchReviewPhase1(taskId, originalStatus, isTerminalAtClaim, snapshot, dispatchToken) {
         let qaTakenOverInReview = false;
         await this.withTaskLock(async () => {
             const fresh = await this.taskStore.get(taskId);
@@ -7033,27 +8133,25 @@ export class AgentManager {
             if (!isTerminalAtClaim && TERMINAL_STATUSES.includes(fresh.status))
                 return;
             // transition 后的中间态恒为 review 且持有本次 dispatch 的 token；status 漂移（如 REQUEST_CHANGES→fixing）
-            // 或 review 内 token 换代（push recheck 接管）都表示 pass 已归并发推进方所有，只撤本次 dispatch 的轮次残留
+            // 或 review 内 token 换代（push recheck 接管）都表示 pass 已归并发推进方所有。
+            // 计轮送达时才落账，claim 段无轮次残留可撤——drift 后不覆盖接管方的任何写入
             const passTakenOver = dispatchToken !== undefined && fresh.signalToken !== dispatchToken;
             qaTakenOverInReview = !isTerminalAtClaim && fresh.status === 'review' && passTakenOver;
             const drifted = !isTerminalAtClaim && (fresh.status !== 'review' || passTakenOver);
-            // 只在本次 dispatch 仍拥有该 pass（未 drift）且确实 bump 过时才撤回 +1；
-            // drift 后 reviewRound 归接管方所有（它可能基于此再 bump），一律不减
-            const rolledRound = (!drifted && roundBumped) ? Math.max(0, fresh.reviewRound - 1) : fresh.reviewRound;
-            const next = drifted
-                ? { ...fresh, reviewRound: rolledRound, updatedAt: new Date().toISOString() }
-                : {
-                    ...fresh,
-                    reviewRound: rolledRound,
-                    qaAgentId: snapshot.qaAgentId,
-                    signalToken: snapshot.signalToken,
-                    reviewDispatchedAt: snapshot.reviewDispatchedAt,
-                    // 本代新铸的 pair 从未交付 QA：不随快照恢复会让旧 QA 的在途 verdict 被拒、新 pair 无人知
-                    passToken: snapshot.passToken,
-                    failToken: snapshot.failToken,
-                    updatedAt: new Date().toISOString(),
-                };
-            if (!isTerminalAtClaim && !drifted) {
+            if (drifted)
+                return;
+            const next = {
+                ...fresh,
+                qaAgentId: snapshot.qaAgentId,
+                signalToken: snapshot.signalToken,
+                reviewDispatchedAt: snapshot.reviewDispatchedAt,
+                reviewRoundPending: snapshot.reviewRoundPending,
+                // 本代新铸的 pair 从未交付 QA：不随快照恢复会让旧 QA 的在途 verdict 被拒、新 pair 无人知
+                passToken: snapshot.passToken,
+                failToken: snapshot.failToken,
+                updatedAt: new Date().toISOString(),
+            };
+            if (!isTerminalAtClaim) {
                 next.status = originalStatus;
                 next.reviewHeadAnchorSha = snapshot.reviewHeadAnchorSha;
             }
@@ -7451,6 +8549,9 @@ export class AgentManager {
         const agent = this.getAgentConfig(agentId);
         if (!agent)
             return;
+        // Pin the incarnation before the first state/paneId read: paneId equality is ABA-blind (a recreated
+        // agent reuses %0), so a DELETE→same-id recreate would otherwise let post-merge /clear hit a new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         const state = await this.agentStore.get(agentId);
         if (!state)
             return;
@@ -7465,12 +8566,16 @@ export class AgentManager {
             return;
         }
         if (!state.taskId) {
+            if (this.isDeletionInFlight(agentId))
+                return;
             const lockToken = await this.lockManager.acquire(agentId, ctx.taskId);
             if (!lockToken)
                 return;
-            await this.agentStore.update(agentId, (existing) => {
+            const commit = await this.agentStore.update(agentId, (existing) => {
                 if (!existing)
                     return AGENT_STORE_NOOP;
+                if (!this.deletionGateOpen(agentId, genAtEntry))
+                    return AGENT_STORE_NOOP;
                 if (existing.taskId && existing.taskId !== ctx.taskId)
                     return AGENT_STORE_NOOP;
                 if (existing.creationToken)
@@ -7485,17 +8590,35 @@ export class AgentManager {
                     lockToken,
                     updatedAt: new Date().toISOString(),
                 };
+            }).catch(async (err) => {
+                await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken).catch((releaseErr) => {
+                    console.warn(`[AgentManager] postMergeCleanup(${agentId}): lock release after commit failure also failed:`, releaseErr);
+                });
+                throw err;
             });
+            if (commit !== 'committed') {
+                await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken);
+                return;
+            }
             const fresh = await this.agentStore.get(agentId);
             if (fresh?.taskId !== ctx.taskId || fresh.lockToken !== lockToken) {
                 await this.lockManager.releaseIfOwner(agentId, ctx.taskId, lockToken);
                 return;
             }
         }
+        // A DELETE→recreate (gen bump) before this pane work must skip it, or /clear lands on the new incarnation's reused pane.
+        if (!this.deletionGateOpen(agentId, genAtEntry))
+            return;
         const runner = this.createRunnerFor(agent);
         const tmux = new TmuxManager(runner);
         const runtime = agentRuntimeKindFor(agent);
-        void this.runPostMergeCompaction(tmux, state.paneId, agentId, ctx.taskId, runtime).catch(err => console.warn(`[AgentManager] runPostMergeCompaction(${agentId}) failed:`, err));
+        const expectedPaneId = state.paneId;
+        void (async () => {
+            if (!this.deletionGateOpen(agentId, genAtEntry))
+                return;
+            const pane = await this.resolveClaimedPane(tmux, agentId, expectedPaneId);
+            await this.runPostMergeCompaction(tmux, pane, agentId, ctx.taskId, runtime);
+        })().catch(err => console.warn(`[AgentManager] runPostMergeCompaction(${agentId}) failed:`, err));
     }
     async releasePostMergeAgent(agentId, taskId) {
         const state = await this.agentStore.get(agentId);
@@ -7508,10 +8631,10 @@ export class AgentManager {
             console.warn(`[AgentManager] releasePostMergeAgent: releaseAgentForTask(${agentId}, ${taskId}) failed:`, err);
         }
     }
-    async runPostMergeCompaction(tmux, paneId, agentId, originalTaskId, runtime) {
+    async runPostMergeCompaction(tmux, pane, agentId, originalTaskId, runtime) {
         await this.acquireCompactGuard(agentId);
         try {
-            await this.runPostMergeCompactionSteps(tmux, paneId, agentId, originalTaskId, runtime);
+            await this.runPostMergeCompactionSteps(tmux, pane, agentId, originalTaskId, runtime);
         }
         finally {
             this.compactInFlight.delete(agentId);
@@ -7537,7 +8660,8 @@ export class AgentManager {
         this.compactInFlight.add(agentId);
         return true;
     }
-    async runPostMergeCompactionSteps(tmux, paneId, agentId, originalTaskId, runtime) {
+    async runPostMergeCompactionSteps(tmux, pane, agentId, originalTaskId, runtime) {
+        const paneId = pane.paneId;
         const initial = await this.agentStore.get(agentId);
         if (!initial || initial.taskId !== originalTaskId || initial.paneId !== paneId)
             return;
@@ -7557,13 +8681,13 @@ export class AgentManager {
         let cleared = false;
         let clearError;
         try {
-            cleared = await this.sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, bindingStillOurs);
+            cleared = await this.sendPostMergeSlashCommand(tmux, pane, agentId, runtime, bindingStillOurs);
         }
         catch (err) {
             clearError = err;
         }
         if (!cleared) {
-            if (await this.recoverPostMergeExitedRuntime(tmux, paneId, agentId, originalTaskId, lockToken, runtime)) {
+            if (await this.recoverPostMergeExitedRuntime(tmux, pane, agentId, originalTaskId, lockToken, runtime)) {
                 cleared = true;
             }
             else if (!await bindingStillOurs()) {
@@ -7572,7 +8696,7 @@ export class AgentManager {
             else if (clearError instanceof Error
                 && clearError.message.includes('runtime rejected /clear')) {
                 try {
-                    await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+                    await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
                 }
                 catch (err) {
                     clearError = err;
@@ -7590,10 +8714,11 @@ export class AgentManager {
         }
         await this.releasePostMergeAgent(agentId, originalTaskId);
     }
-    async recoverPostMergeExitedRuntime(tmux, paneId, agentId, taskId, lockToken, runtime) {
+    async recoverPostMergeExitedRuntime(tmux, pane, agentId, taskId, lockToken, runtime) {
+        const paneId = pane.paneId;
         let paneExists = true;
         try {
-            if (hasReplProcTitle(await tmux.displayMessage(paneId, '#{pane_current_command}'), runtime))
+            if (hasReplProcTitle(await tmux.displayMessage(pane, '#{pane_current_command}'), runtime))
                 return false;
         }
         catch (err) {
@@ -7612,7 +8737,7 @@ export class AgentManager {
             return false;
         try {
             if (paneExists)
-                await tmux.sendKeysToPane(paneId, 'C-c');
+                await tmux.sendKeysToPane(pane, 'C-c');
             const ensure = await this.ensureSession(agentId, 'runtime');
             if (!ensure.freshRuntime)
                 return false;
@@ -7641,22 +8766,22 @@ export class AgentManager {
             return false;
         }
     }
-    async sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, bindingStillOurs) {
+    async sendPostMergeSlashCommand(tmux, pane, agentId, runtime, bindingStillOurs) {
         let rejection;
         for (let attempt = 1; attempt <= 2; attempt++) {
             if (!await bindingStillOurs())
                 return false;
-            await tmux.clearComposerDraft(paneId);
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+            await tmux.clearComposerDraft(pane);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
             if (!await bindingStillOurs())
                 return false;
-            await tmux.sendKeysLiteral(paneId, '/clear');
-            await tmux.sendEnter(paneId);
+            await tmux.sendKeysLiteral(pane, '/clear');
+            await tmux.sendEnter(pane);
             await new Promise(r => setTimeout(r, this.compactIdlePollMs));
-            await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+            await this.waitForReplPromptReady(tmux, pane, runtime, this.compactIdleWaitMs);
             if (!await bindingStillOurs())
                 return false;
-            if (!await this.hasRuntimeSlashCommandRejection(tmux, paneId, '/clear'))
+            if (!await this.hasRuntimeSlashCommandRejection(tmux, pane, '/clear'))
                 return true;
             rejection = new Error('runtime rejected /clear because a task is still in progress');
             if (attempt < 2) {
@@ -7666,29 +8791,33 @@ export class AgentManager {
         }
         throw rejection ?? new Error('runtime rejected /clear');
     }
-    async hasRuntimeSlashCommandRejection(tmux, paneId, command) {
-        const cap = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+    async hasRuntimeSlashCommandRejection(tmux, pane, command) {
+        const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
         return this.runtimeSlashCommandRejectedPattern(command).test(cap);
     }
     runtimeSlashCommandRejectedPattern(command) {
         return new RegExp(`["'“”‘’]?${command}["'“”‘’]?\\s+is disabled while a task is in progress\\.`, 'gi');
     }
-    async waitForReplPromptReady(tmux, paneId, runtime, timeoutMs) {
+    async waitForReplPromptReady(tmux, pane, runtime, timeoutMs, opts = {}) {
+        if (opts.stableIdle) {
+            return this.waitForReplPromptStableIdle(tmux, pane, runtime, timeoutMs);
+        }
+        const paneId = pane.paneId;
         const deadline = Date.now() + timeoutMs;
-        await tmux.waitReplReady(paneId, runtime, {
+        await tmux.waitReplReady(pane, runtime, {
             timeoutMs,
             intervalMs: this.compactIdlePollMs,
             titleIdleFastPath: true,
         });
         await new Promise(r => setTimeout(r, this.compactIdlePollMs));
         while (true) {
-            const current = await tmux.displayMessage(paneId, '#{pane_current_command}');
+            const current = await tmux.displayMessage(pane, '#{pane_current_command}');
             if (!hasReplProcTitle(current, runtime)) {
                 throw new Error(`waitForReplPromptReady: pane ${paneId} pane_current_command=${current.trim()} (not runtime, REPL may have exited)`);
             }
-            const cap = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+            const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
             const ready = hasRuntimeReadyView(cap, runtime)
-                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(paneId), runtime));
+                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(pane), runtime));
             if (detectRuntimeMenu(cap) || (!ready && detectStartupDialog(cap, runtime))) {
                 throw new Error(`waitForReplPromptReady: pane ${paneId} shows menu/dialog, not a ready REPL prompt`);
             }
@@ -7699,11 +8828,41 @@ export class AgentManager {
                 return;
             }
             if (Date.now() >= deadline) {
-                throw new Error(`waitForReplPromptReady: pane ${paneId} stayed busy past ${timeoutMs}ms`);
+                // 与 stableIdle 分支同一类型：忙碌超时是「常态忙」而非故障，调用方（release/派发）
+                // 据此延后重排；菜单/对话框/REPL 退出等仍是普通 Error，不得被当成可延后
+                throw new ReplNotReadyError(paneId, runtime, cap, `stayed busy past ${timeoutMs}ms`);
             }
             await new Promise(r => setTimeout(r, this.compactIdlePollMs));
         }
     }
+    // 注入前置门：codex 忙碌回合的工具间隙会闪现单帧 idle footer（#558 事故放大器），
+    // 连续 K 帧稳定就绪才放行，任何忙碌/不确定帧清零计数；超时按忙碌分类抛 ReplNotReadyError。
+    async waitForReplPromptStableIdle(tmux, pane, runtime, timeoutMs) {
+        const paneId = pane.paneId;
+        const samples = Math.max(1, this.readyStableSamples);
+        const spacing = this.readyStableSpacingMs;
+        const deadline = Date.now() + timeoutMs + (samples - 1) * spacing;
+        let streak = 0;
+        while (true) {
+            const current = await tmux.displayMessage(pane, '#{pane_current_command}');
+            if (!hasReplProcTitle(current, runtime)) {
+                throw new Error(`waitForReplPromptReady: pane ${paneId} pane_current_command=${current.trim()} (not runtime, REPL may have exited)`);
+            }
+            const cap = await tmux.capturePaneById(pane, { ansi: false, scrollback: 0 });
+            const ready = hasRuntimeReadyView(cap, runtime)
+                || (screenAllowsTitleIdle(cap, runtime) && hasOscTitleIdle(await tmux.readPaneTitle(pane), runtime));
+            if (detectRuntimeMenu(cap) || (!ready && detectStartupDialog(cap, runtime))) {
+                throw new Error(`waitForReplPromptReady: pane ${paneId} shows menu/dialog, not a ready REPL prompt`);
+            }
+            streak = ready && !runtimeBusyCheck(cap, runtime) ? streak + 1 : 0;
+            if (streak >= samples)
+                return;
+            if (Date.now() >= deadline) {
+                throw new ReplNotReadyError(paneId, runtime, cap, `stable idle not confirmed within ${timeoutMs}ms (+${(samples - 1) * spacing}ms stability window)`);
+            }
+            await new Promise(r => setTimeout(r, spacing));
+        }
+    }
     stopPhaseSignalWatcher(taskId) {
         this.phaseSignalWatcher?.stop(taskId);
     }
@@ -7733,6 +8892,8 @@ export class AgentManager {
                 ...(opts.onlyReplaceOwnToken ? { onlyReplaceOwnToken: true } : {}),
                 ...(opts.replaceScope ? { replaceScope: opts.replaceScope } : {}),
                 ...(opts.onReadFile ? { onReadFile: opts.onReadFile } : {}),
+                ...(opts.needInputMode ? { needInputMode: opts.needInputMode } : {}),
+                ...(opts.needInputPaneCutover ? { needInputPaneCutover: true } : {}),
             });
         }
         catch (err) {
@@ -7743,6 +8904,10 @@ export class AgentManager {
     async armPostDispatchSignalOrHold(taskId, agentId, expectedKinds, token, skipSnapshot = false, onReadFile) {
         const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, token, {
             skipSnapshot,
+            // Every post-dispatch arm follows a freshly injected prompt: the previous
+            // question is superseded, its watermark must not carry over (fix/publish
+            // continuations included).
+            needInputMode: 'fresh',
             ...(onReadFile ? { onReadFile } : {}),
         });
         if (!armed)
@@ -7783,7 +8948,10 @@ export class AgentManager {
         // pair 的重铸已随「进入 review 的 transition」单写落盘（spec §7 与新轮可见性原子）；
         // 这里只轮换 signal token 并布防
         await this.updateTask(taskId, { signalToken: newToken });
-        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken, isGit ? { replaceScope: 'agent' } : {});
+        const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken, {
+            needInputMode: 'fresh',
+            ...(isGit ? { replaceScope: 'agent' } : {}),
+        });
         if (armed && isGit && kinds.includes('pr-approved'))
             await this.rearmGitReconciliationWatcher(taskId);
         return { token: newToken, armed };
@@ -7805,6 +8973,7 @@ export class AgentManager {
                 signalToken: restore.signalToken,
                 reviewHeadAnchorSha: restore.reviewHeadAnchorSha,
                 reviewDispatchedAt: restore.reviewDispatchedAt,
+                reviewRoundPending: restore.reviewRoundPending,
                 ...(restore.restorePair === true
                     ? { passToken: restore.passToken, failToken: restore.failToken }
                     : {}),
@@ -8192,7 +9361,7 @@ export class AgentManager {
             signalToken,
             specDocuments,
             ...(currentSpecRound !== undefined ? { currentSpecRound } : {}),
-            armBeforeInject: () => this.setupPhaseSignalWatcher(task.id, devAgentId, expectedKind, signalToken),
+            armBeforeInject: () => this.setupPhaseSignalWatcher(task.id, devAgentId, expectedKind, signalToken, { needInputMode: 'fresh' }),
         };
         return this.isResearchHandoff(task, devAgentId)
             ? this.startSession(task.id, devAgentId, 'code', {
@@ -8456,6 +9625,7 @@ export class AgentManager {
                 dispatchedCheckoutMode = ctx.serverReviewCheckout;
                 const allowReadFile = opts.phase === 'spec' || opts.continuation || ctx.serverReviewCheckout === 'base';
                 return this.setupPhaseSignalWatcher(taskId, qaId, expectedKind, newToken, {
+                    needInputMode: 'fresh',
                     ...(allowReadFile
                         ? { onReadFile: (req) => { void this.handleReadFileRequest(taskId, qaId, req); } }
                         : {}),
@@ -8677,7 +9847,7 @@ export class AgentManager {
             // Callers without a baseSha (publish) run long after the review diff was
             // read; refresh origin/HEAD first or upstream commits merged since then
             // would linger in base..HEAD and flag tasks that leak nothing.
-            const fetch = await execNetwork(runner, `${GIT_NET_ENV} git -C ${shellQuote(workdir)} fetch origin --quiet`);
+            const fetch = await execNetwork(runner, `${canonicalSelfGuard(workdir)} && ${GIT_NET_ENV} git -C ${shellQuote(workdir)} fetch origin --quiet`);
             if (fetch.exitCode !== 0) {
                 throw new Error(`lineage fetch failed in ${workdir}: ${fetch.stderr.trim()}`);
             }
@@ -8808,6 +9978,8 @@ export class AgentManager {
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             throw new Error(`injectTextToAgent: unknown agent ${agentId}`);
+        // Pin the incarnation before reading state so a DELETE→recreate reusing %0 can't route the text to the new session.
+        const genAtEntry = this.deletionGenerationOf(agentId);
         await this.acquireCompactGuard(agentId);
         try {
             const state = await this.agentStore.get(agentId);
@@ -8842,8 +10014,18 @@ export class AgentManager {
                 await this.assertTaskLockOwner(agentId, taskId, lockToken);
             }
             const tmux = new TmuxManager(this.createRunnerFor(cfg));
-            await tmux.injectPrompt(paneId, text, agentId);
-            await tmux.sendEnter(paneId);
+            const pane = await this.resolveClaimedPane(tmux, agentId, paneId);
+            // resolveClaimedPane resolved by the CURRENT same-name session; re-verify incarnation + binding before paste (same as the image path).
+            if (!this.deletionGateOpen(agentId, genAtEntry)) {
+                throw new Error(`injectTextToAgent: agent ${agentId} was deleted or recreated before paste`);
+            }
+            const afterResolve = await this.agentStore.get(agentId);
+            if (!afterResolve || afterResolve.paneId !== paneId || afterResolve.taskId !== taskId
+                || (taskId !== undefined && afterResolve.lockToken !== lockToken)) {
+                throw new Error(`injectTextToAgent: agent ${agentId} binding changed before paste`);
+            }
+            await tmux.injectPrompt(pane, text, agentId);
+            await tmux.sendEnter(pane);
         }
         finally {
             this.compactInFlight.delete(agentId);
@@ -9000,14 +10182,17 @@ export class AgentManager {
     }
     startCompactionThenRelease(agentId, state, taskId) {
         // 人工介入/重建中的 pane 不发 /clear;confirm 语义要求解绑,落回直接释放
-        if (!state.paneId || state.status === 'awaiting_human' || state.creationToken)
+        const expectedPaneId = state.paneId;
+        if (!expectedPaneId || state.status === 'awaiting_human' || state.creationToken)
             return false;
         const cfg = this.getAgentConfig(agentId);
         if (!cfg)
             return false;
         const tmux = new TmuxManager(this.createRunnerFor(cfg));
-        void this.runPostMergeCompaction(tmux, state.paneId, agentId, taskId, agentRuntimeKindFor(cfg))
-            .catch(err => console.warn(`[AgentManager] releaseTaskAgents compaction(${agentId}) failed:`, err));
+        void (async () => {
+            const pane = await this.resolveClaimedPane(tmux, agentId, expectedPaneId);
+            await this.runPostMergeCompaction(tmux, pane, agentId, taskId, agentRuntimeKindFor(cfg));
+        })().catch(err => console.warn(`[AgentManager] releaseTaskAgents compaction(${agentId}) failed:`, err));
         return true;
     }
     repoMergeQueue = new Map();
@@ -9023,13 +10208,15 @@ export class AgentManager {
         const runner = this.createRunnerFor(dev);
         const prev = this.repoMergeQueue.get(task.projectId) ?? Promise.resolve();
         const run = prev.then(async () => {
+            // fetch/push reach a remote derived from THIS Workdir; a rebound Workdir would redirect the push to a foreign repo, so each mutation carries the canonical self-guard in its own command.
+            const guard = `${canonicalSelfGuard(workdir)} && `;
             const cd = `cd ${shellQuote(workdir)} && `;
             const db = await runner.exec(`${cd}git symbolic-ref --short refs/remotes/origin/HEAD`);
             const defaultBranch = db.stdout.trim().replace(/^origin\//, '');
             if (db.exitCode !== 0 || defaultBranch === '') {
                 throw new Error(`ffMergeBranch: cannot resolve default branch: ${db.stderr.trim() || 'empty origin/HEAD'}`);
             }
-            const fetch = await execNetwork(runner, `${cd}${GIT_NET_ENV} git fetch origin`);
+            const fetch = await execNetwork(runner, `${guard}${cd}${GIT_NET_ENV} git fetch origin`);
             if (fetch.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [git fetch] failed: ${fetch.stderr.trim()}`);
             }
@@ -9043,7 +10230,7 @@ export class AgentManager {
             else {
                 throw new Error(`ffMergeBranch: no reviewed head recorded for task ${task.id}; cannot safely merge`);
             }
-            const push = await execNetwork(runner, `${cd}${GIT_NET_ENV} git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
+            const push = await execNetwork(runner, `${guard}${cd}${GIT_NET_ENV} git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
             if (push.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [push] failed: ${push.stderr.trim() || push.stdout.trim()}`);
             }